A large-scale software supply-chain attack has compromised thousands of GitHub accounts and exposed secrets across more than 1,800 repositories. According to Aikido Security, an attacker used stolen credentials to gain write access to GitHub accounts and planted a malicious continuous-integration (CI) workflow designed to steal cloud credentials, tokens, and other sensitive information. The malicious code was inserted into repositories and often removed within minutes, making the incident difficult to detect. The campaign demonstrates how compromised developer accounts can be weaponized to attack the software supply chain, potentially affecting organizations far beyond the initially targeted repositories.
The attackers reportedly gained control of 4,837 hijacked GitHub accounts and used their write permissions to insert a secret-stealing payload into repositories. The malicious workflow ran in at least 1,806 repositories, meaning credentials and cloud roles accessible to those repositories’ CI pipelines should be treated as compromised. The campaign began with seemingly harmless pull requests titled “docs: dependency audit notes,” submitted from branches named wfx-docs. These requests were opened in 61,764 repositories, apparently to test whether the compromised accounts could write to them, before malicious commits were added to a smaller group of targets.
A separate analysis by SafeDep identified 8,093 public repositories that received malicious commits between 12:46 UTC on Tuesday and 04:36 UTC the following day. Because the researchers examined only default branches of public repositories, the actual number of affected repositories is likely higher. In 7,309 repositories, the attacker added the stealer to an existing GitHub Actions workflow. In another 771 repositories, it was inserted as an npm postinstall hook, which could execute on a developer’s machine when they ran npm install. After deploying the payload, the attacker frequently reverted the changes within minutes and deleted workflow logs, sometimes removing the workflow run entirely.
The malware collected a broad range of sensitive material from CI runners, including GitHub Actions secrets and variables, the workflow’s GITHUB_TOKEN, OIDC and runtime tokens, AI-service keys, and credentials stored in process memory. It also searched for credential files associated with AWS, Azure, Google Cloud, Kubernetes, npm, PyPI, and SSH. The attack was not limited to stealing short-lived tokens: researchers found that the malware could exchange GitHub OIDC tokens for AWS, Google Cloud, and Azure sessions, potentially allowing the attacker to move deeper into cloud environments.
On AWS, the stealer could create long-lived access keys for IAM users and rewrite a role’s trust policy to make it accessible from other AWS accounts. In Azure, it could add federated identity credentials prefixed with wfx-ci- to Entra ID applications, allowing workflows to authenticate even after original tokens were rotated. Repository owners should search for suspicious branches such as wfx-docs, ci-check-[0-9]{4}, and short-lived chore/ branches. They should also look for pull requests titled “docs: dependency audit notes” and commits labeled ci: refresh build cache, chore: add ci helper, ci: restore, or ci: cleanup.
Other indicators include unexpected workflow files, a .ci-xxxxxx.sh script, an npm postinstall hook, and the SHA-256 hash 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf. Affected repository owners should immediately revoke the compromised account’s tokens, OAuth grants, SSH keys, and active sessions, then enable two-factor authentication. They must also rotate every secret, variable, cloud credential, and API key that the affected repository or CI workflow could access. Developers who ran npm install on an affected commit should treat their machines as compromised and rotate local keys and credentials.
Organizations should also review GitHub Actions permissions, restrict workflow access to secrets, require approval for changes from outside collaborators, and monitor cloud logs for suspicious identity activity. This incident highlights that developer accounts, CI systems, and cloud identities are now primary targets in software supply-chain attacks, making strong authentication, least-privilege access, secret rotation, and continuous monitoring essential defenses.
