The attack unfolded through trusted maintainer identities. Using the account of Takashi Kitao, the author of the pyxel game engine, which has around 18,400 stars on GitHub, the attacker pushed a malicious workflow into 27 repositories beginning at 13:20 UTC. The campaign is characterized as ongoing, with the goal of stealing credentials from systems that execute the tampered workflows.

Key points from the disclosure:

• The campaign targets GitHub Actions workflows in open-source projects.
• Two high-profile maintainer accounts were compromised.
• More than 340 repositories have been affected.
• The pyxel project, a game engine with roughly 18,400 stars, was among those used as a vector.
• 27 repositories received the malicious workflow starting at 13:20 UTC.
• The activity is described as an ongoing credential-theft operation.

For maintainers and organizations relying on CI/CD pipelines, this is a reminder that compromise of a single trusted account can propagate quickly across many downstream repositories. Anyone with workflows tied to affected projects should review recent workflow changes and treat credentials accessible to those runners as potentially exposed.

Source: The Hacker News

Has your organization audited its GitHub Actions workflows and maintainer account security in light of this campaign?