Someone with a lot of patience and a clear plan has been quietly poisoning the open-source software supply chain. Security researchers at StepSecurity have disclosed an active campaign in which attackers compromised at least two high-profile maintainer accounts on GitHub and used them to push malicious workflow files into over 340 repositories — all without the real owners knowing.

The opening move was elegant in its simplicity. The attacker took control of the account belonging to Takashi Kitao, maintainer of pyxel — a Python game engine with 18,400 GitHub stars, meaning plenty of downstream trust. From that account, starting at 13:20 UTC, malicious GitHub Actions workflows were pushed to 27 repositories. The workflows were designed to harvest credentials — API keys, tokens, secrets — from any CI/CD pipeline that ran them.

GitHub Actions workflows are a particularly attractive target because they run automatically when code is pushed or a pull request is opened. If a developer's fork of a compromised repo triggers a workflow, their secrets go with it. It's the software equivalent of booby-trapping a door that thousands of people walk through every day.

Why this matters beyond the immediate incident: This isn't an isolated miscreant. It's a demonstration that the supply chain attack surface has expanded well beyond package registries like npm or PyPI. Workflow files are code too — they just live in a different part of your repo. Most security scanning tools still treat them as configuration rather than executable attack surface.

The campaign also highlights a structural problem: open-source maintainers are high-value targets but low-resource defenders. A single compromised account with commit access to dozens of repos can propagate malware faster than most security teams can detect it. The trust that makes open-source collaboration work is exactly the mechanism being exploited here.

For defenders right now: If your organisation runs pipelines that depend on third-party GitHub Actions or workflows from community repositories, the risk isn't theoretical. The CISA supply chain guidance and Australia's ACSC both recommend pinning Actions to specific commit SHAs rather than mutable tags — because a tag like @v3 can be silently redirected. If you're not doing this, you're trusting that no maintainer account ever gets compromised. Today's news suggests that trust is misplaced.

The broader context is also worth noting. Software supply chain attacks — SolarWinds, XZ Utils, the npm typosquatting campaigns — have been a persistent theme for half a decade. Each incident produces recommendations. Each set of recommendations is only partially implemented before the next incident arrives. The 340 repositories compromised here are unlikely to be the final count; researchers are still mapping the full scope.

Watch for: GitHub's official response on whether additional accounts were compromised, which repositories specifically had the malicious workflows triggered in live pipelines, and whether any secrets were successfully exfiltrated. The scale of downstream exposure depends heavily on how many forks and dependent projects inadvertently executed the poisoned workflows before they were pulled.