TLDR Tech / News
Malicious GitHub workflows targeting credentials found in thousands of repos
A supply chain attack, identified as GhostAction, has compromised prominent open-source maintainers, leading to the insertion of fraudulent GitHub Actions workflows into tens of thousands of code repositories. These compromised workflows are disguised as security checks but are designed to steal sensitive information, including CI/CD secrets and API keys for cloud and AI services, transmitting them to an unauthorized server.
Read the full story