Attackers Use Comp GitHub Maintainer Accounts to Seed Credential Theft Workflows
Researchers reveal a campaign using stolen maintainer credentials to inject malicious GitHub Actions into hundreds of open-source repositories.
Key points
- Two high-profile open-source maintainer accounts were compromised to push malicious workflows.
- The attack targeted over 340 repositories, including those associated with the pyxel game engine.
- The malicious workflows are designed to steal credentials from the affected projects.
Cybersecurity researchers have disclosed an ongoing credential-theft campaign that leverages compromised maintainer accounts to inject malicious GitHub Actions workflows into open-source repositories. According to a report by The Hacker News, attackers have successfully pushed these malicious files into more than 340 repositories by exploiting the elevated privileges of two high-profile developer accounts.
The investigation highlights a specific incident involving Takashi Kitao, the author of the popular game engine pyxel, which has accumulated over 18,400 stars on GitHub. StepSecurity researchers identified that the attacker utilized Kitao’s compromised account to push a malicious workflow to 27 repositories. This specific wave of injections began at 13:20 UTC. The broader campaign has affected a total of over 340 repositories, indicating that multiple maintainer accounts were likely breached to facilitate the widespread distribution of the malicious code.
Campaign Mechanics and Scope
The attack vector relies on the trust inherent in open-source maintenance. By compromising the accounts of established maintainers, attackers can bypass standard scrutiny that might be applied to pull requests from unknown contributors. The malicious workflows are designed to execute during the repository’s continuous integration or continuous deployment processes. When triggered, these workflows are intended to harvest sensitive credentials, such as API keys, tokens, or private keys, which are often stored as secrets within the GitHub Actions environment.
The scale of the compromise suggests a coordinated effort to maximize the number of potential victims. By targeting repositories with significant community interest, such as pyxel, the attackers increase the likelihood that other developers will clone or depend on the compromised code, potentially amplifying the spread of the malicious logic or exposing additional infrastructure. The use of high-profile accounts adds a layer of credibility that makes the malicious workflows less likely to be immediately flagged by automated security tools or human reviewers.
Who Is Affected
Developers and organizations that depend on open-source libraries hosted on GitHub are at risk, particularly those who use projects maintained by the compromised accounts. The direct impact is felt by the maintainers whose accounts were stolen, as their reputation and the integrity of their projects are compromised. Additionally, any downstream projects that have integrated the affected repositories into their own build pipelines may have inadvertently executed the malicious workflows.
The attack underscores the vulnerability of open-source supply chains where access controls are tied to individual maintainer credentials. If a maintainer’s account is compromised, the attacker gains the ability to modify the project’s automation scripts, which often run with high privileges. This means that the security of the repository is only as strong as the security of the maintainer’s personal account.
What should you do?
Security teams and developers should audit their dependency trees for any projects linked to the compromised maintainer accounts. Organizations should review their GitHub Actions workflows for any unauthorized changes, especially those that were pushed directly by maintainers rather than through standard pull request processes. It is critical to rotate any secrets or credentials that may have been exposed in the affected repositories.
What to do and how to stay safe: GitHub
- Audit all GitHub Actions workflows in your repositories for recent unauthorized changes, particularly those pushed directly by maintainers.
- Rotate any API keys, tokens, or secrets that were stored in the compromised repositories or used in the affected workflows.
- Review access logs for your GitHub organizations to identify any suspicious activity or unauthorized access to maintainer accounts.
- Enable required status checks and code review policies to prevent direct pushes to main branches, reducing the risk of malicious workflow injection.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many repositories were affected by this credential theft campaign?
The campaign has compromised over 340 repositories, with 27 specifically linked to the compromised account of Takashi Kitao.
Which high-profile project was mentioned in the report?
The pyxel game engine, authored by Takashi Kitao, was highlighted as one of the projects affected by the malicious workflow injections.
What is the primary goal of the malicious workflows?
The workflows are designed to steal credentials, such as API keys and tokens, from the GitHub Actions environment of the affected repositories.
