According to a report published by The Hacker News on 12 November 2026, an attacker utilized stolen credentials belonging to 4,837 GitHub accounts to run a continuous integration secret-stealing payload across thousands of repositories. The coordinated campaign involved active exploitation where malicious commits were injected into a large number of software projects, impacting development pipelines and software packages alike.

The campaign was tracked by security researchers from SafeDep and Aikido Security, who detailed the mechanics of the operation and its exfiltration servers. Initial activity began with test pull requests opened across tens of thousands of repositories to check for write access before deploying the actual payload. The operation targeted both existing workflows and package installation hooks to spread the malicious code.

Technical analysis revealed that SafeDep researchers tracked malicious commits across 8,093 repositories between 12:46 UTC on Tuesday and 04:36 UTC on Wednesday. Among the impacted repositories, 7,309 had the stealer added to an existing workflow, while 771 received it via an npm postinstall hook. Specific package impacts included the Packagist package digitalelvis/neuronai-studio version 3.14.3 and Go modules such as github.com/onuragtas/docker-env and github.com/vkuznet/gocurl.

The deployed secret stealer is capable of harvesting GitHub Actions secrets and variables, the GITHUB_TOKEN, OIDC and runtime tokens, AI service keys, runner process memory, and configuration files for AWS, Azure, GCP, Kubernetes, npm, PyPI, and SSH. Furthermore, the attacker attempted to establish deep cloud persistence while affecting a small number of software packages during the widespread compromise.

This large-scale incident poses severe risks for software supply chain security, as compromised continuous integration pipelines can expose critical infrastructure credentials and cloud environments. Developers and organizations whose repositories or dependencies were touched by the campaign face potential unauthorized access, data exfiltration, and downstream vulnerabilities across their connected software ecosystems.

Security teams should revoke commit author tokens, OAuth app grants, SSH keys, and active user sessions, while enforcing mandatory two-factor authentication. Organizations must rotate every secret, variable, and cloud credential that affected repositories or workflows could read, inspect repositories for anomalies such as missing run numbers on attacker commits, and treat any machine that executed npm install on an affected commit or package as fully compromised.

Stay alert, and keep your security measures updated!

Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news