What the researchers observed
Socket reports that two compromised maintainer accounts added a workflow called security-audit.yml to 346 repositories during an October burst. The file was presented as a security audit, but its behavior was credential collection. Its reach included automation secrets and a sweep of the working tree and git history for credentials.
Socket later expanded its observation to more than 500 accounts committing the workflow to tens of thousands of repositories since October 7. Those figures describe different observation windows. They are not independent counts of successful exfiltration, and the report should not be read as evidence that every affected repository ran the workflow.
Why execution history matters
A committed workflow is a trust-boundary breach because a repository file can run with privileges attached to Actions jobs. Socket identifies kitao/pyxel as the clearest case in which publishing credentials were targeted by a successful run. For each repository, examine whether the injected workflow was merely present or actually executed, then map the specific job permissions and secrets accessible at that time.
A repository may also have credentials committed elsewhere in its history. Removing the workflow file does not remove those credentials, nor does it undo a completed run. Review relevant branches, history and run artifacts before narrowing the exposure scope.
Response boundary
Socket advises treating a completed run as exfiltration of the named secrets. Rotate those credentials, invalidate sessions where possible, and inspect downstream publishing or cloud activity. For repositories without a completed run, retain evidence and check whether other workflow paths or tokens were abused.
The published research does not establish compromise of every downstream consumer of these repositories. Keep the investigation tied to observed workflow execution, available privileges and subsequent account activity.
Evidence and review
Incident date: Unknown. Evidence checked .
Merged by pankajmouriya · Editorial merge