A secret-stealing script was planted in thousands of repositories through 4,837 compromised GitHub accounts. Aikido said the script ran in at least 1,806 repos, while SafeDep reported changes in 8,093 repos.
A malicious script was planted in thousands of repositories through 4,837 compromised GitHub accounts. The script's goal is to harvest secrets stored in repos, such as API keys and access tokens.
Two security firms report different scales:
The gap may stem from different detection methods; the source does not provide further detail.
A script that slips into a repository can reach every secret tied to that project. That puts not only the project at risk but also the cloud services and third-party integrations those secrets unlock.
The source does not say when the campaign began, which accounts were affected, or whether GitHub has commented. A precise impact assessment needs more information.
GitHub is shared infrastructure for the software world, and a script planted across thousands of repos can expose secrets that unlock connected cloud accounts. It is a concrete prompt for developers to review repo permissions and secret management.
