Attackers compromised developer accounts to inject credential-stealing workflows into hundreds of repositories, targeting stored secrets and historical code data.
Workflow injection hides in plain sight within environment variables, requiring static analysis of code rather than just runtime monitoring to catch the exploit before it executes.
