Researchers find GitHub campaign stole secrets from at least 1,835 targets

Aikido researchers confirmed that a campaign using 4,837 compromised GitHub accounts stole secrets from at least 1,835 targets, BleepingComputer reported. The campaign began November 10 and probed 61,764 repositories for write access through pull requests disguised as dependency audit notes. Attackers inserted a credential-stealing script through GitHub Actions workflows or an npm install hook. The script collected cloud and developer credentials and could exchange workflow identity tokens for cloud sessions. Automated publishing also carried the payload into Packagist and Go module releases. Not every targeted repository executed the payload; Aikido believes secret theft was the primary objective.