60,000 GitHub Repos Poisoned via Hijacked Accounts and Workflow Injection
Written by AI from the linked story. Not reviewed by an editor. How this works
The attacker compromised thousands of developer and bot accounts to inject credential-stealing code directly into GitHub Actions workflows, shell scripts, and npm hooks — trusted components of the software development pipeline. This is a classic supply chain attack: by targeting the build and automation layer rather than production systems directly, the attacker harvested GitHub tokens, cloud credentials, and AI service keys at scale. The incident highlights how overprivileged bot accounts and poorly reviewed CI/CD configurations create a massive attack surface. When credentials stolen from one repository can pivot into AWS or Azure environments, the blast radius extends far beyond source code.
Tactical Insight
Immediate actions
- Audit all GitHub Actions workflows, npm hooks, and shell scripts in your repositories for unauthorized modifications or unexpected code insertions.
- Rotate all GitHub tokens, cloud credentials (AWS, Azure), and AI service keys that may have been exposed in CI/CD environments.
- Revoke and re-issue credentials for any bot or service accounts associated with affected repositories.
Long-term improvements
- Enforce least-privilege access for all developer and bot accounts, scoping GitHub tokens to only the repositories and permissions they strictly require.
- Require code review and branch protection rules for all changes to CI/CD pipeline files (e.g., `.github/workflows/`) to prevent unauthorized workflow modifications.
- Adopt secrets management solutions (e.g., HashiCorp Vault, AWS Secrets Manager) so credentials are never embedded in workflow files or scripts.
Detection measures
- Enable GitHub audit log streaming and alert on unexpected changes to workflow files, new workflow runs from unfamiliar accounts, or unusual token usage patterns.
- Implement runtime monitoring in cloud environments (AWS CloudTrail, Azure Monitor) to detect lateral movement or anomalous API calls originating from CI/CD pipelines.
- Scan repositories continuously with secret-scanning tools to detect committed credentials before they can be exfiltrated.