Massive GitHub CI attack steals secrets from thousands of repositories

Starting Tuesday, a coordinated cyberattack leveraged stolen credentials from 4,837 GitHub accounts to infiltrate software supply chains. The attackers planted malicious code designed to steal secrets and cloud credentials from Continuous Integration (CI) workflows in at least 1,806 repositories. This campaign highlights the severe risks associated with compromised developer identities and automated build pipelines.

What happened

The attack began with the attacker opening test pull requests titled "docs: dependency audit notes" from branches named "wfx-docs." These tests were deployed across 61,764 repositories to verify write access. In repositories where access was granted, the attacker injected a secret stealer into the CI configuration. According to Aikido Security, the stealer was designed to harvest secrets, cloud credentials, and runtime tokens accessible to the workflow environment. SafeDep researchers identified 8,093 repositories that received malicious commits between 12:46 UTC on Tuesday and 04:36 UTC the following day, noting that the actual number is likely higher as their analysis covered only public default branches.

Once the stealer was executed, it typically exfiltrated data via HTTP POST to specific IP addresses or through Telegram chats. The attacker often reverted the changes within minutes and deleted the workflow run logs to obscure evidence. However, the damage was already done in many cases. The stealer targeted a wide array of credentials, including GitHub Actions secrets, OIDC tokens, and keys for AWS, Azure, GCP, and Kubernetes. In some instances, the malware was introduced via npm postinstall hooks, meaning any developer who ran "npm install" on the affected commit potentially compromised their local machine.

Key details

• Scale: 4,837 GitHub accounts were compromised, with test pull requests sent to 61,764 repositories.
• Impact: The stealer ran in at least 1,806 repositories, with malicious commits found in over 8,093 repositories.
• Method: Attacks started with pull requests titled "docs: dependency audit notes" from "wfx-docs" branches.
• Persistence: The malware creates backdoors in AWS and Azure that survive credential rotation, such as rewriting trust policies.
• Indicators: Look for branches like "wfx-docs," "chore/[a-z0-9]{8}," or commit messages like "ci: refresh build cache."
• Affected Packages: Malicious versions were found in Packagist package digitalelvis/neuronai-studio v3.14.3 and several Go modules.

Background

Continuous Integration (CI) systems like GitHub Actions automate the process of building, testing, and deploying code. To function, these workflows often require access to sensitive credentials, such as cloud provider keys or database passwords. These secrets are stored in the repository settings and injected into the runner environment during execution. If an attacker gains write access to a repository, they can modify the workflow files to include malicious steps that print or send these secrets to an external server.

This attack specifically exploits OpenID Connect (OIDC) tokens, which allow CI runners to authenticate with cloud providers without storing long-lived secrets. By stealing these short-lived tokens, the attacker can request new sessions from cloud providers. More dangerously, the stealer includes logic to create persistent backdoors, such as adding federated identity credentials in Azure or creating long-lived access keys in AWS. This ensures the attacker maintains access even after the initial compromised tokens are rotated.

Why it matters

For teams running their own software or managing self-hosted infrastructure, this incident underscores the critical importance of securing CI/CD pipelines. Many organizations assume that because their code is private or their runners are self-hosted, they are immune to such attacks. However, the stealer was designed to target private repositories and self-hosted runners, extracting credentials from instance metadata and Docker container states. If your CI pipeline has broad permissions, a single compromised commit can lead to a full cloud account takeover.

The persistence mechanisms used by the attacker make remediation difficult. Simply rotating secrets is insufficient if the attacker has modified cloud identity policies. Teams must audit their cloud configurations for unauthorized federated credentials or trust policy changes. Furthermore, the use of npm postinstall hooks means the threat extends beyond the CI environment to developer workstations. Any team member who pulled the malicious code may have inadvertently installed malware, requiring a broader incident response effort.

What you can do

• Audit repositories: Search for branches named "wfx-docs," "chore/[a-z0-9]{8}," or pull requests with the title "docs: dependency audit notes."
• Rotate credentials: Immediately rotate all secrets, variables, and tokens in affected repositories. Revoke OAuth app grants and SSH keys for compromised accounts.
• Check cloud logs: Look for unusual activity in AWS CloudTrail, Azure Entra ID, and GCP logs, specifically for "AssumeRoleWithWebIdentity" or federated credentials prefixed with "wfx-ci-."
• Inspect local machines: If you ran "npm install" on a potentially affected commit, treat your machine as compromised and rotate local keys.
• Block malicious packages: Pin digitalelvis/neuronai-studio to v3.14.2 or earlier and remove affected versions of github.com/onuragtas/docker-env and github.com/vkuznet/gocurl.
• Enable 2FA: Ensure two-factor authentication is enabled for all GitHub accounts to prevent credential stuffing attacks.