Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories

Attackers leveraged compromised GitHub credentials to inject malicious workflow files into tens of thousands of repositories, silently exfiltrating GitHub Actions secrets and cloud credentials during CI/CD pipeline execution. The attack propagated further through automated triggers in published package ecosystems such as Packagist and Go modules, amplifying the blast radius into downstream consumers. This illustrates how a single set of stolen credentials can weaponize a trusted software supply chain at massive scale. Secrets stored in CI/CD environments are high-value targets precisely because they often carry privileged access to cloud infrastructure, container registries, and deployment systems.