Malicious GitHub Workflows Infect 340 Repositories via Hijacked Maintainer Accounts
Attackers compromised two open-source maintainer accounts to plant credential-stealing workflows in over 340 repositories, exposing projects to data theft.
Key points
- Two high-profile open-source maintainer accounts were compromised to push malicious code.
- Over 340 repositories received infected GitHub Actions workflows.
- The campaign targeted the popular pyxel game engine and other projects.
A credential-theft campaign has infected more than 340 open-source repositories by abusing the access rights of two high-profile maintainer accounts. Cybersecurity researchers disclosed the details of this ongoing operation, which leverages trusted developer identities to plant malicious automation scripts. These scripts are designed to harvest sensitive credentials from the affected projects and their users.
How it unfolded
- The attacker used the account of Takashi Kitao, author of the pyxel game engine, to begin the campaign.
- Starting at 13:20 UTC, the intruder pushed a malicious workflow to 27 repositories linked to Kitao.
- The operation expanded to include a second compromised maintainer account, reaching over 340 repositories in total.
Who is affected
The pyxel project, a widely used game engine with 18,400 stars on GitHub, was a primary target. According to The Hacker News, the attackers used Kitao’s account to inject the malicious code into his repositories. The scope of the breach extends beyond pyxel, as the second compromised maintainer account allowed the threat actors to spread the infection to hundreds of additional projects. Developers relying on these libraries may have unknowingly executed the harmful workflows.
The fix
No official patch or remediation guide has been confirmed by GitHub or the affected maintainers yet. Users of the compromised repositories should exercise caution when running automated workflows. The malicious code was planted directly into the project configurations, meaning standard dependency checks may not detect it. Security teams must manually review recent workflow changes in any affected repositories to identify and remove the unauthorized scripts.
Background: Threat actors
A threat actor is any entity that initiates a cyber attack. They range from automated software to organised criminal groups. Understanding their motive helps you predict their behaviour. Most are not after you specifically but exploit common weaknesses for quick financial gain.
Read the full guide: Threat Actors Explained: Motives, Methods and Misconceptions
What to do and how to stay safe: GitHub
- Review recent changes to GitHub Actions workflows in your repositories, especially those made by maintainers.
- Audit the permissions of all maintainer accounts to ensure no unauthorized access remains.
- Monitor for unusual outbound network traffic from your CI/CD pipelines that could indicate data exfiltration.
- Once the vendor provides an update or guidance, apply the recommended remediation steps immediately.
Step-by-step guide: Incident Response Plans: Real Benefits and Hidden Costs
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific projects were targeted in this campaign?
The pyxel game engine, created by Takashi Kitao, was targeted, with 27 of its repositories infected. The campaign also affected over 340 other repositories linked to a second compromised maintainer.
What do the malicious workflows do?
The workflows are designed to steal credentials. They operate within the GitHub Actions environment, potentially accessing secrets and sensitive data stored in the compromised repositories.
Is there a CVE ID for this vulnerability?
No CVE ID has been assigned to this specific campaign or the method of intrusion. The attacks relied on compromised account credentials rather than a software flaw.
