Stolen GitHub logins planted a CI secret stealer in 1,800+ repos. Check yours for "docs: dependency audit notes"
Since November 10, an attacker using 4,837 stolen GitHub accounts has pushed a credential stealer into repositories those accounts can write to, according to Aikido Security. It ran in more than 1,800 repos and erases its own workflow logs. If a probe pull request titled "docs: dependency audit notes" reached any repo you can write to, rotate every secret its workflows can read and check your AWS and Azure accounts for backdoors.











