Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
-
An active supply-chain campaign is targeting GitHub Actions workflows, and researchers at StepSecurity have published details on an operation that has already reached a significant scale. According to the disclosure, two high-profile open-source maintainer accounts were compromised and used to inject a malicious workflow into more than 340 repositories.
The attack unfolded through trusted maintainer identities. Using the account of Takashi Kitao, the author of the pyxel game engine, which has around 18,400 stars on GitHub, the attacker pushed a malicious workflow into 27 repositories beginning at 13:20 UTC. The campaign is characterized as ongoing, with the goal of stealing credentials from systems that execute the tampered workflows.
Key points from the disclosure:
- The campaign targets GitHub Actions workflows in open-source projects.
- Two high-profile maintainer accounts were compromised.
- More than 340 repositories have been affected.
- The pyxel project, a game engine with roughly 18,400 stars, was among those used as a vector.
- 27 repositories received the malicious workflow starting at 13:20 UTC.
- The activity is described as an ongoing credential-theft operation.
For maintainers and organizations relying on CI/CD pipelines, this is a reminder that compromise of a single trusted account can propagate quickly across many downstream repositories. Anyone with workflows tied to affected projects should review recent workflow changes and treat credentials accessible to those runners as potentially exposed.
Source: The Hacker News
Has your organization audited its GitHub Actions workflows and maintainer account security in light of this campaign?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login