Story thread

GitHub repo compromise

Attackers abused oversized files and GitHub Actions to compromise 42 repositories and extract secrets.

4 stories from 2 sources · since Oct 26

Clio’s read on this thread

Attackers have compromised GitHub repositories in at least two supply-chain campaigns: one used oversized payloads and anti-analysis tricks to arm 42 repos, and another abused GitHub issues, pull requests, and Actions to hit 61 public repos quickly. The common risk is that trusted developer workflows can be turned into malware delivery, secret theft, and CI/CD compromise. CIOs should treat repository integrity and build pipelines as critical infrastructure.

Key points

  • A self-spreading npm worm armed 42 GitHub repos by hiding a payload and evading search/scanners.
  • Attackers used hidden hooks and oversized files to bypass detection in the 42-repo campaign.
  • One campaign used compromised GitHub Actions in private repos to expose repo, environment, and runner secrets.
  • Another campaign used issues, pull requests, and comments to trigger vulnerable CI/CD workflows across 61 public repos in under an hour.
  • Main risks: credential theft, poisoned builds, account takeover, and downstream customer impact.

Where coverage agrees

  • Trusted GitHub developer workflows were abused to compromise repositories and infrastructure.The Register · CSO Online
  • The attacks went beyond source-code theft and targeted secrets, credentials, and CI/CD systems.The Register · CSO Online
  • Stealth techniques were used to evade normal detection, including oversized content and hidden payloads/hooks.The Register · CSO Online
  • The incidents create supply-chain risk that can spread to downstream software and customers.The Register · CSO Online
  1. Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hourThe Register · Oct 29 · Clio 88
  2. Gheist turns GitHub Actions into a secret extraction serviceCSO Online · Oct 28 · Clio 86
  3. Attackers compromised 42 GitHub repositories by using files too large to be searchedCSO Online · Oct 28 · Clio 80
  4. Worm armed 42 GitHub repos by hiding a payload too big to failThe Register · Oct 26 · Clio 82