Compromised pyxel dev account used to push credential-stealing workflows to 340 GitHub repos
Attackers compromised high-profile developer accounts to inject malicious workflows into hundreds of repositories, stealing credentials from victims.
Key points
- Attackers hijacked the account of Takashi Kitao, creator of the popular pyxel game engine.
- Malicious workflows were pushed to at least 27 repositories starting at 13:20 UTC.
- The campaign has infected over 340 repositories using stolen maintainer credentials.
Cybercriminals have successfully infiltrated high-profile open-source maintainer accounts to distribute credential-stealing tools across GitHub. According to a report by The Hacker News, this ongoing campaign has compromised accounts belonging to trusted developers. The attackers used these hijacked identities to push malicious automation workflows into repositories, exposing thousands of projects to potential data breaches.
In plain English
Open-source software relies on trust between users and the developers who maintain the code. When attackers take over the accounts of well-known maintainers, they gain immediate credibility. Users often assume that code coming from a trusted maintainer is safe. This campaign exploits that trust by injecting hidden scripts that run automatically when code is updated. These scripts are designed to steal sensitive information from the systems that use the compromised repositories.
The background
The investigation highlights a specific incident involving Takashi Kitao, the author of pyxel, a game engine with 18,400 stars on GitHub. StepSecurity researchers observed the attacker using Kitao’s compromised account to push a malicious workflow to 27 repositories. The activity began at 13:20 UTC. This specific action is part of a broader campaign that has resulted in the infection of more than 340 repositories. The scale of the compromise underscores the risk of account hijacking in the open-source ecosystem.
What changes now
Organizations relying on open-source components must reassess their trust models. The fact that high-profile accounts can be compromised means that star counts and follower numbers are no longer sufficient indicators of safety. Security teams need to monitor for unexpected changes in repository configurations, particularly in automation workflows. The infiltration of over 340 repositories suggests that the attack surface is wide. Companies should verify the integrity of their dependencies and check for unauthorized access tokens or secrets that may have been exposed during these automated runs.
What to do and how to stay safe: GitHub
- Audit GitHub Actions workflows in all internal repositories to identify any scripts added by external maintainers recently.
- Rotate all access tokens and secrets that may have been exposed in environments running compromised workflows.
- Implement strict branch protection rules that require manual approval for changes to workflow files.
- Monitor for unauthorized login attempts or unusual activity on maintainer accounts used in critical projects.
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific repository was used to start the malicious workflow distribution?
The attackers used the account of Takashi Kitao, the author of the pyxel game engine, to push the malicious workflow.
How many repositories have been infected by this campaign so far?
The campaign has compromised over 340 repositories, including 27 repositories specifically targeted via the pyxel maintainer account.
When did the observed malicious activity from the pyxel account begin?
The attacker pushed the malicious workflow to repositories starting at 13:20 UTC, according to StepSecurity researchers.
