How it unfolded

1. 1

   An injected script extracts a read/write token

   A malicious script running in CI took advantage of a permissive workflow-level default and pulled out a GITHUB_TOKEN scoped for both read and write.

2. 2

   The CI script itself is replaced on a new branch

   Using that token, the attacker created a new branch that swapped in a tampered version of the legitimate CI script.

3. 3

   The publish workflow is triggered directly via the API

   Rather than waiting for a normal push, the attacker invoked workflow_dispatch through the GitHub API to run the publish workflow against their tampered branch — one that still carried a vulnerable workflow definition already reverted on master.

4. 4

   NPM_TOKEN is exfiltrated during the tampered publish

   Because the publish workflow had NPM_TOKEN in scope, running it against the attacker's branch exfiltrated that token directly. The attacker then deleted the branch and workflow run history to reduce the trail.

5. 5

   Phase two: stolen tokens flip repos public

   With the stolen GitHub tokens, the attacker flipped thousands of private repositories to public within a short window.

6. 6

   Downstream: an OIDC trust chain reaches full AWS admin

   A separate threat-intel group rode the exposure to full AWS administrator access at a victim org in under 72 hours, chaining OIDC trust relationships with a CloudFormation IAM capability — no zero-day involved.