Summary Points
-
GitHub accounts compromised: Stolen credentials from 4,837 accounts were used to test access across 61,764 repositories; malicious commits reached at least 8,093 public repositories.
-
CI secrets targeted: A stealthy credential stealer ran in at least 1,806 repositories, harvesting workflow, cloud, developer, and package-publishing credentials—sometimes leaving persistent cloud backdoors.
-
Assume exposure: Any account targeted by the test pull requests may be compromised, even if no stealer ran. Affected secrets and machines that ran the malicious npm hook should be treated as exposed.
- Act and investigate: Revoke tokens and sessions, rotate all accessible secrets and keys, enable 2FA, and check repositories and cloud logs for the listed branches, commits, and
wfx-ci-*backdoors.
A broad attack on GitHub workflows
An attacker used credentials from 4,837 GitHub accounts to target repositories across GitHub, security researchers reported. The attacker first opened test pull requests in 61,764 repositories. Then the attacker added a secret-stealing script to some projects.
Researchers found the script ran in at least 1,806 repositories. A separate review counted 8,093 public repositories that received malicious commits, but that figure includes projects where the script may not have run. The reviews covered public repositories, so the full reach remains unknown.
The script searched automated build systems for passwords, cloud access keys, and other credentials. It could also copy repository files and workflow records, then send stolen data to remote servers or a messaging service. In some cases, the attacker removed the changes within minutes, which made the activity harder to spot.
Most attempts did not lead to a confirmed script run. However, researchers warned that accounts targeted by the test pull requests may still be compromised. The campaign shows how trust in shared software projects can become a risk: one stolen account may have access to many repositories.
What repository owners should do
Repository owners should look for suspicious branches named “wfx-docs,” unusual workflow changes, or pull requests titled “docs: dependency audit notes.” They should also review recent activity, since a missing record of a workflow run does not prove that no data escaped.
If a repository shows signs of an attack, owners should revoke the account’s access tokens and rotate every secret the workflow could reach. They should also check cloud accounts for unfamiliar access changes and enable two-factor authentication. Anyone who installed a malicious package version should treat the affected computer as potentially compromised and replace its credentials.
These steps can take time, especially for teams that manage many projects. Still, regular access reviews and limited workflow permissions can reduce the damage from future account theft. For developers and organizations that rely on open-source tools, careful checks help preserve the collaboration that makes shared software useful.
Stay Ahead with the Latest Tech Trends
Explore the future of technology with our detailed insights on Artificial Intelligence.
Stay inspired by the vast knowledge available on Wikipedia.
DataProtection-V1
