4,837 GitHub accounts had their CI secrets stolen this month — and GitHub wasn't hacked.

The attackers exploited a configuration pattern that has been in GitHub's own security documentation for years. They found public repositories using the pull_request_target trigger, forked them, added a credential-exfiltration script to the test code, and opened a pull request. The workflow ran. Tokens and secrets left the environment in seconds.

No CVE was assigned because there is no platform vulnerability. The bug is in the workflow files developers write, not in GitHub. The fix is not a patch. It is an audit.

Why pull_request_target is dangerous when it runs PR code

The pull_request event runs in the fork's context — read-only token, no secrets. That's the safe default.

pull_request_target runs in the base repository's context — write-scoped GITHUB_TOKEN, full access to environment secrets, OIDC identity tokens. It was designed for bots that need to label or comment on PRs from forks. If the workflow also checks out and runs the PR's code, that untrusted code runs with maintainer-level credentials.

The two events differ by a single word in YAML. That's the whole attack surface.

The supply chain multiplier

A stolen GITHUB_TOKEN with write scope can commit to the repository. A stolen npm token can publish a backdoored package to every downstream consumer. A stolen AWS key can reach the cloud environment the job was meant to deploy to.

The 4,837 figure is confirmed direct exfiltration. The downstream impact is orders of magnitude larger.

What to do now

  1. Audit every workflow using pull_request_target, issue_comment, or workflow_run
  2. Remove code execution from any workflow running in the base repo's context
  3. Add permissions: contents: read to the top of every workflow
  4. Rotate every secret a vulnerable workflow could reach
  5. Replace long-lived cloud credentials with OIDC where possible
  6. Check package registries for releases published outside normal cadence
  7. Enable secret scanning and push protection on every repository

Full technical breakdown with hunt queries and the complete checklist: https://threataft.com/articles/github-ci-secret-stealer-4837-accounts