Thousands of GitHub accounts were exploited by an attacker who used stolen credentials to insert a credential-stealing script into numerous repositories. According to Aikido Security, this breach involved 4,837 accounts, affecting at least 1,806 repositories.
Exploitation Methodology
The attack began with the attacker submitting a pull request titled ‘docs: dependency audit notes’ from a branch named ‘wfx-docs’ to check write access. This was executed in 61,764 repositories, with the credential-stealing script deployed in several instances.
SafeDep, a firm specializing in software supply chain security, reported that 8,093 repositories received malicious commits between Tuesday and Thursday. These actions targeted the default branches of public repositories, suggesting a potentially greater reach.
Impact on Repositories
The script added to workflows in 7,309 repositories and as an npm postinstall hook in 771 others. The attacker often reverted changes shortly after implementation, making detection challenging. Affected repositories should consider all accessed secrets as compromised.
New pull requests with similar titles were identified after the initial attack timeline, indicating ongoing risks. Compromised accounts are vulnerable even if the stealer did not successfully execute in their repositories, Aikido Security warns. The method by which credentials were initially obtained remains unclear.
Security Recommendations
Owners of affected repositories are advised to revoke access tokens, enable two-factor authentication, and rotate all accessible secrets. Machines running npm install during the attack should be considered compromised.
Signs of a compromise include branches titled ‘wfx-docs,’ specific commit messages, and IP addresses associated with data exfiltration. The stealer is designed to collect a wide range of credentials, potentially affecting both public and private repositories.
SafeDep’s findings suggest the attack primarily aims to gather CI secrets rather than spread malware through package distribution. Nevertheless, compromised packages and modules have been identified, prompting recommendations for blocking certain versions and pinning to safer releases.
This incident shares similarities with past attacks, such as the GhostAction wave in October, though Aikido Security has not confirmed the same perpetrator. The evolving nature of these threats underscores the need for robust security measures in software development environments.
Organizations are urged to stay vigilant and implement comprehensive security protocols to prevent future breaches.
