Source: thehackernews.com
An ongoing credential-theft campaign has compromised at least two high-profile open-source maintainer accounts to push malicious GitHub Actions workflows into over 340 repositories. The attacker leveraged the account of Takashi Kitao, author of the popular 18,400-star game engine 'pyxel', to push malicious workflows to 27 repositories beginning at 13:20 UTC. The campaign targets developer credentials and secrets stored within CI/CD pipelines. The scale of the attack—affecting tens of thousands of repositories—signals a sophisticated and broad supply chain compromise. Security firm StepSecurity is credited with uncovering and disclosing the details of this active campaign. The attack highlights the growing risk of compromised maintainer accounts being weaponized for downstream supply chain attacks via GitHub Actions.
