A credential-stealing GitHub Actions campaign has been planted in tens of thousands of repositories, according to reporting published October 9. Socket said it identified more than 500 GitHub accounts that committed the malicious workflow since October 7, illustrating how trusted automation can become a software supply-chain entry point.
What defenders should do
Review recent workflow changes, rotate secrets that may have been exposed to affected runners, restrict workflow permissions, and require review for changes to CI configuration. Repository owners should also audit organization-level Actions settings and third-party action pinning.
Source: The Hacker News.