GhostAction Never Stopped: 1,900 Accounts, 30,000 Repos, and a Year of Stolen Keys
Between October 8 and 12, roughly 1,900 compromised developer accounts pushed malicious GitHub Actions workflow files into more than 30,000 repositories, with a major spike on October 8 and 9. GitHub
