What happened
From Nov 10-12 the attacker used stolen credentials for 4,837 GitHub accounts to open 'docs: dependency audit notes' probe PRs in ~61,764 repos, then pushed a CI secret stealer ('wfx') into thousands of repos. It ran in at least 1,806 repos, harvested GitHub Actions secrets, OIDC/runtime tokens, AI-service keys and cloud credentials, and rewrote AWS role trust policies / added Azure federated identities to persist after rotation, deleting its logs and often reverting the commit within minutes.
Why it matters
This is a mass-scale supply-chain attack on the developer/AI ecosystem. The stealer explicitly collects 'keys for AI services' and the cloud roles that AI pipelines and coding agents bind to, and it labors to survive credential rotation. Any AI team whose CI builds, containers or automation read these repos should treat all their secrets as exposed.
Attack vector
Using stolen GitHub credentials, the attacker opens test pull requests from wfx-docs branches then pushes a workflow or npm postinstall hook that runs a self-erasing secret-stealer script on the CI runner / developer machine, exfiltrating CI secrets and cloud credentials to attacker C2 or Telegram, and planting persistence backdoors.
Affected systems
Any GitHub repository the 4,837 compromised accounts could write to; GitHub Actions workflows and npm postinstall hooks (package.json). Indicators: wfx-docs branch, 'docs: dependency audit notes' PR titles, .ci-*.sh script, WFX-BEGIN step summaries.
Mitigation
Revoke the compromised commit author's tokens, OAuth app grants, SSH keys and sessions; rotate every CI secret/variable the repo can read; enable 2FA; treat any machine that ran npm install on an affected commit as compromised. Hunt for wfx-ci-* federated credentials in Entra, wfx-* AssumeRoleWithWebIdentity/CreateAccessKey in AWS CloudTrail, and wfx-cache artifacts.