Attacker uses 4,837 hijacked GitHub accounts to plant CI secret stealer in at least 1,806 repositories

An attacker used stolen credentials for 4,837 GitHub accounts to place a secret-stealing payload in repositories those accounts could write to, according to Aikido Security. The payload targeted secrets and cloud credentials reachable from continuous integration workflows. It ran in at least 1,806 repositories. The operation began with pull requests titled docs: dependency audit notes from branches named wfx-docs, probing write access in 61,764 repositories before malicious commits followed.

Aikido said the stealer usually arrived in existing CI workflows or as an npm postinstall hook, which also runs during local installation. Researchers at SafeDep counted 8,093 public repositories receiving malicious commits between Tuesday 12:46 UTC and Wednesday 04:36 UTC, with 7,309 workflow insertions and 771 hook changes. The attacker often reverted commits and deleted logs quickly. The analysis did not explain how credentials were obtained.

The incident shows a shift from compromising software artifacts to compromising developer trust: hijacked identities, not just malicious packages, became the delivery channel. GitHub accounts with organization or collaborator access were used in 10,431 test pull requests, indicating abuse of delegated permissions rather than only owner credentials. That pattern matters because CI systems often inherit broad secrets from trusted accounts, so a single compromised contributor can expose infrastructure keys without altering shipped code.

Aikido said repositories with the stealer should treat workflow secrets, cloud roles, and variables as compromised, and developers who ran npm install on affected commits should treat their machines as compromised. Owners need to revoke tokens, OAuth grants, SSH keys, and sessions, rotate secrets, and enable two-factor authentication. The exposed scope extends beyond the 1,806 confirmed runs because SafeDep said its public search undercounts private or non-default branches.