Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
Attackers compromised two prominent open-source maintainer accounts—including pyxel's 18k-star author—to inject credential-stealing GitHub Actions workflows into 340+ repositories, underscoring the fragility of CI/CD supply-chain trust.
Summary written by editorial AI · Source link below
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories.
"Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity
Editorial Analysis
Any organisation consuming open-source dependencies through GitHub is exposed; a single compromised maintainer can cascade malicious code across hundreds of downstream projects.
Audit all GitHub Actions workflows for third-party references, pin actions to commit SHAs, and require review approvals for workflow file changes.
Compromised open-source maintainer accounts were used to inject credential-stealing code into hundreds of software projects, highlighting systemic supply-chain risk.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the DevSecOps Desk
- 11 of 23 Core Open Source Projects Run on 1 or 2 People9 Oct
- PackMonitor: Enabling Zero Package Hallucinations Through Decoding-Time Monitoring9 Oct
- Applying Security by Design at the Point of Execution: How Governed Security Requirements Affect the Security of AI-Generated Code9 Oct
- Arbiter: Detecting Interference in LLM Agent System Prompts9 Oct
- DITTO: A Context-aware Pickle-based Pre-Trained Model Scanner for Effective Security Audits9 Oct