Hijacked GitHub accounts push a secret stealer into thousands of repositories (wfx-loot) (WFX-LOOT)

13 November 2026HighBeing exploited

GitHub · GitHub repositories, GitHub Actions and npm installs · WFX-LOOT

Hijacked GitHub accounts push a secret stealer into thousands of repositories (wfx-loot)

From 10 November an attacker used stolen credentials for about 4,800 GitHub accounts to push a secret-stealing script into other people's repositories, a campaign Aikido Security calls wfx-loot. It runs inside GitHub Actions, or on a developer's own machine through an npm postinstall hook, and collects repository secrets, cloud, npm and SSH credentials and AI service keys, then tries to leave backdoors in AWS and Azure accounts. This is not a flaw in GitHub, so there is no CVE and nothing to patch: the accounts themselves were compromised. The attacker usually reverts the change within minutes, so a repository can look clean afterwards.

Affected: Any GitHub repository that a compromised account could write to, including as a collaborator or organisation member. SafeDep counted 8,093 public repositories that received a malicious commit between 10 and 12 November: 7,309 through a change to an existing workflow and 771 through an npm postinstall hook. Aikido found the stealer ran in at least 1,806 repositories. Known affected packages are Packagist digitalelvis/neuronai-studio 3.14.3 and Go modules github.com/onuragtas/docker-env v1.0.278 and v1.0.280. SafeDep found no affected published npm packages among those it scanned, but anyone who ran npm install on an affected commit was exposed.
What to do: Search your repositories, from 10 November onwards, for a pull request titled "docs: dependency audit notes", a branch named wfx-docs, or commits titled "ci: refresh build cache" or "chore: add ci helper". If the pull request exists, the account that opened it is compromised even if nothing else followed: revoke its tokens, OAuth app grants, SSH keys and sessions, and turn on two-factor authentication. If the stealer ran, rotate every secret and variable the repository's workflows can read, and check AWS for unexpected access keys or changed role trust policies and Microsoft Entra for federated credentials named wfx-ci- that you did not create. Treat any machine that ran npm install on an affected commit as compromised and rotate its keys. Block the package versions listed.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: An active attack on the GitHub and npm workflow that our own projects and many clients' sites are built with; widely covered.

Hijacked GitHub accounts push a secret stealer into thousands of repositories (wfx-loot)

Affected

Any GitHub repository that a compromised account could write to, including as a collaborator or organisation member. SafeDep counted 8,093 public repositories that received a malicious commit between 10 and 12 November: 7,309 through a change to an existing workflow and 771 through an npm postinstall hook. Aikido found the stealer ran in at least 1,806 repositories. Known affected packages are Packagist digitalelvis/neuronai-studio 3.14.3 and Go modules github.com/onuragtas/docker-env v1.0.278 and v1.0.280. SafeDep found no affected published npm packages among those it scanned, but anyone who ran npm install on an affected commit was exposed.

What to do

Search your repositories, from 10 November onwards, for a pull request titled "docs: dependency audit notes", a branch named wfx-docs, or commits titled "ci: refresh build cache" or "chore: add ci helper". If the pull request exists, the account that opened it is compromised even if nothing else followed: revoke its tokens, OAuth app grants, SSH keys and sessions, and turn on two-factor authentication. If the stealer ran, rotate every secret and variable the repository's workflows can read, and check AWS for unexpected access keys or changed role trust policies and Microsoft Entra for federated credentials named wfx-ci- that you did not create. Treat any machine that ran npm install on an affected commit as compromised and rotate its keys. Block the package versions listed.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

An active attack on the GitHub and npm workflow that our own projects and many clients' sites are built with; widely covered.