Since Tuesday, someone has been using stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repos those accounts could write to, The Hacker News and Help Net Security report, citing Aikido Security. It ran in at least 1,806 repos. SafeDep separately counted 8,093 repos with malicious commits, and that only covers default branches of public repos.
- It starts with a test PR titled docs: dependency audit notes from a
wfx-docsbranch. Those went to 61,764 repos, including 10,431 through collaborator or org access. - Most stealers were added to an existing workflow. 771 came as an npm
postinstallhook, which also runs on developers’ machines. - The attacker usually reverted within minutes and deleted the run logs.
- Commit messages to look for:
ci: refresh build cache,chore: add ci helper,chore: add dependency audit workflow,chore: initial commit.
What to do
If the stealer ran, treat every secret and cloud role your workflows can reach as compromised and rotate them. Any account that opened a test PR is compromised even if nothing else happened, so revoke its tokens, OAuth grants, SSH keys and sessions and turn on 2FA. If you ran npm install on an affected commit, rotate that machine’s keys too. My checklist is in this batch.
My take
New PRs with the same title were still showing up this morning. Go look now, even if your repos are small. These were stolen accounts, not targeted projects.
God Bless, and Use the Source!
