grep -rl "github-actions" ./articles
GitGuardian's update records about 1,900 compromised GitHub accounts and more than 30,000 repositories targeted on 8 and 9 October. The number missing from every headline is how many secrets the campaign actually took, and the one wave with a published answer makes the gap look enormous.
Trusted Publishing was the thing everyone was told to adopt because it removes long-lived tokens. It verified publishers by GitHub repository name rather than by the repository's permanent id, so a renamed or deleted repo could be taken over and used to publish to an existing package.
Socket's latest GhostAction wave commits a credential-stealing GitHub Actions workflow straight to default branches. The payload is reusable, but the attackers read each repository's existing workflows first to learn which secret names to ask for. The October variant also sweeps the full git history.