How-To: Check Your GitHub Repos for This Week’s CI Secret Stealer

Here’s what I ran against my own repos after the wfx-docs campaign. You need the GitHub CLI (gh), logged in.

1. Look for the test PRs

gh search prs "docs: dependency audit notes" --owner YOUR-USER-OR-ORG --state all

Run it for each org you belong to. Any hit means the account that opened it is compromised.

2. Check recent workflow and npm changes

In each local clone:

git fetch --all
git log --all --since=2026-11-10 --stat -- .github/workflows package.json '.ci-*'

Look for the commit messages ci: refresh build cache, chore: add ci helper, chore: add dependency audit workflow or a new build-audit-*.yml. Remember the attacker usually reverted fast, so check the history, not just the current files.

3. Look for runs that disappeared

gh run list --limit 50

If there are gaps around the suspicious commits, assume a run was deleted.

4. Clean up your own account

gh auth status
gh ssh-key list

In GitHub settings, review Sessions, Applications (OAuth and GitHub Apps), personal access tokens and the security log. Revoke anything you don’t recognize and make sure 2FA is on.

5. If anything matched, rotate

Rotate every repo and org secret, deploy key and cloud role the workflows can reach. If you ran npm install on a bad commit, rotate that machine’s keys too. From now on I install packages with npm install --ignore-scripts on anything I haven’t reviewed.

God Bless, and Use the Source!

References & Further Reading

• Attacker used 4,837 hijacked GitHub accounts to run a CI secret stealer (The Hacker News)
• Reviewing your security log (GitHub Docs)
• gh search prs manual (GitHub CLI)