Credential‑Stealing GitHub Actions Workflows Inserted into 340+ Repositories via Compromised Maintainer Accounts

What happened

Two high‑profile open‑source maintainer accounts were compromised and used to push malicious GitHub Actions workflows into 340+ repositories. The workflows capture CI secrets and exfiltrate them to attacker‑controlled endpoints.

Why it matters for trust and compliance

• This scenario illustrates why continuous control‑assurance over privileged identities and CI/CD pipeline changes is essential for audit readiness and defensible evidence.
• Demonstrates the need for continuous monitoring of privileged account activity and workflow changes.
• Provides evidence that robust credential‑management and least‑privilege policies are critical control objectives across frameworks.

Who is affected

Recommended actions

1. Enforce MFA and strong password policies for all GitHub accounts with write access.
2. Apply least‑privilege repository permissions and restrict workflow creation rights.
3. Implement continuous monitoring of workflow changes and generate immutable audit logs.
4. Rotate any exposed secrets and scan repositories for malicious workflow files.