Compromised GitHub accounts planted a secret-stealing payload in thousands of repositories

Security firm Aikido Security reports that about 4,837 compromised GitHub accounts opened test pull requests across 61,764 repositories beginning November 10. The payload reportedly executed in at least 1,806 of them, and SafeDep identified 8,093 repositories that received malicious commits before its search ended. The commits were made under real users' identities and, in some cases, collaborator or bot accounts, so fork-related safeguards do not stop them. The malware collects Actions secrets, tokens, and cloud credentials, and can create AWS keys or add Azure federated credentials that persist even after rotation. Affected maintainers are advised to check commit history and workflow runs for signs of the attack and to rotate and audit credentials.