Massive Cyber Breach Hits GitHub
On November 10, GitHub experienced a significant cyberattack that resulted in the theft of passwords and access keys from at least 1,835 projects. The attacker exploited 4,837 compromised accounts in an attempt to infiltrate 61,764 projects. This breach involved malware designed to harvest credentials for cloud platforms such as Amazon, Microsoft, and Google, as well as AI services including OpenAI, Anthropic, and Gemini.
Currently, 92% of the malicious code change requests remain unresolved. The malware not only stole passwords and access keys but also established persistent access to cloud accounts. Stolen data was transmitted to the attacker’s servers before the unauthorized changes were removed within a minute. Victimized accounts included those from Fortune 100 companies, the U.S. General Services Administration, the French government, and other organizations. Approximately 50 of these accounts had permissions to publish packages on npm and PyPI repositories.
Advice for GitHub Project Owners
Project maintainers on GitHub are strongly urged to audit their repositories for signs of compromise. If any evidence of infection is found, all passwords and access keys should be replaced immediately. This incident bears similarities to the GhostAction campaign from 2025, raising concerns among cybersecurity professionals.
This breach highlights the critical vulnerabilities organizations face when relying on GitHub for software development. Losing control over key resources can lead to significant financial damage and harm to reputation. Security experts recommend strengthening protections by enabling two-factor authentication and conducting frequent security audits to help prevent future attacks.
The recent breach at GitHub is reminiscent of another significant incident where state-sponsored hackers infiltrated a cloud service, impacting data security for numerous organizations. For a deeper understanding of the implications of such cyberattacks and how they affect businesses globally, you can read more about the ConnectWise cloud service breach.