A Stolen GitHub Token Hit 150+ of Our Repos. Here's How We Contained It in a Day

Who we are

Oracular is a small studio building Vedic astrology apps. Our main app, Vyom, gives you your Kundli, every divisional chart, Kundli matching, transits and the daily Panchang in 16 languages, with AI astrologers you can ask about your own chart. We also build VedKal, a Panchang and festival calendar. Behind them sit 17 small services on Cloudflare Workers and six websites on Cloudflare Pages, all deploying straight from GitHub.

That last detail is what made us a target.

What happened

On 12 November 2026 we noticed pull requests called “wfx-docs” appearing across our repositories. Nobody on the team had opened them. A GitHub access token on one of our developer accounts had been stolen and was being used by wfx-loot, a campaign that has hit many teams this month.

Between 11 and 12 November the token pushed to more than 150 of our repositories. It left three kinds of changes:

• Decoy pull requests named wfx-docs, adding a harmless-looking “audit” document.
• chore/ branches with a commit called “chore: add ci helper”. It added a 1,563-line shell script and a postinstall line to package.json.
• Clean-up commits (“ci: restore”, “ci: cleanup”) seconds later, so the final code looks untouched.

The script is a credential stealer. Any build system that runs npm install on one of those commits runs it. It collects environment variables, cloud credentials, AI provider keys and config files, then sends them to the attacker through Telegram.

First, cut every path to production

Our first goal was not cleanup. It was to stop anything from GitHub reaching what our users touch.

1. We locked the GitHub account: signed out every session, revoked its tokens and logged the command-line tools out.
2. We saved the full build settings of every service: repository, branch, commands and variables. Saving them first let us switch everything off without worrying about how to rebuild it.
3. We disconnected automatic builds on all 17 Cloudflare Workers that deploy from GitHub, so no push could start a build.
4. We deleted the 5 build tokens those builds used. They were the only credentials a build could see.

Vyom stayed up the whole time. Switching off builds stops new deploys, not the live services.

Then, find out what they actually got

• Audit log. Cloudflare’s audit log for the attack window showed only Cloudflare’s own build machines and our own address. There were no new API tokens, no new members and no changes we had not made.
• Production branches. 16 of our 17 Workers production branches never received an attacker commit. On the 17th, VedKal’s, the attacker pushed straight to main twice, adding the script and removing it within seconds.
• Production builds. Our pipeline built those VedKal commits, so the stealer ran inside two production builds. The code they deployed was still ours: we read all 1,563 lines, and the script only collects and sends data; it never edits source files. A normal release about four hours later rebuilt all four VedKal services from clean code.
• What a build could see. Our runtime keys live as encrypted Worker secrets, which a build never sees. The stealer could read a build token, which we had already deleted, and a Node.js version number.
• Websites. Our six Cloudflare Pages sites built the attacker’s branches as previews. Their preview environments hold no variables at all, so those builds had nothing to read, and none of the six deployed anything to production during the attack.
• Main branches. We compared each one with its state before the attack. The attacker’s changes added up to zero files.

Next day: clean up, then reconnect tighter than before

• A script swept every repository. It closed 163 attacker pull requests and deleted 173 attacker branches across 167 repositories. A second scan found none left.
• We ran the full safety check again before switching anything back on.
• We reconnected all 17 builds from the saved settings with three changes: builds run only from the production branch, preview builds are off, and 2 new build tokens replace the old 5.
• The new GitHub token for our command-line tools no longer has permission to change CI workflows.
• One build setting had not been written down: the Node.js version for the VedKal services. We recovered it from the build history and restored it.

By the evening of 13 November everything was deploying again.

The habits that kept us safe

The attack worked as designed: it got its script into our builds. It found almost nothing there, because of choices we had made long before.

1. Secrets live in the platform, not in code or build settings. A stealer that runs during a build finds no keys to our databases, AI providers or payments.
2. Everything leaves a trail we can read. Audit logs let us rule out account changes in minutes instead of guessing.
3. Settings are written down before they are changed. That turned “switch off all deploys” from a risky decision into a reversible one.
4. Tokens get the least access they need. We tightened this further: fewer build tokens, and none that can edit workflows.

If you see wfx-docs pull requests

• Assume a token is stolen. Lock the account and revoke its tokens and authorised apps before you clean anything up.
• Pause any CI or build system that runs on pushes, including preview builds of static sites.
• Search your repositories for .ci-*.sh files and for postinstall lines you did not write. Check your main branches too: the attacker pushes there directly when it can.
• Check your cloud provider’s audit log for the days of the attack.
• Rotate every secret your builds could see. If the answer is “none”, you are in good shape.
• Protect your main branches so that even a stolen token cannot push to them directly.

We found no sign that customer data or any live service was touched. The attack cost us a day of focused work, and it left our pipeline tighter than it was before.

About Oracular

Oracular builds Vedic astrology tools for everyday use.

• Vyom: Kundli, divisional charts, Kundli Milan, transits, Panchang and AI astrologers. Free on the App Store and Google Play.
• VedKal: Panchang and festival calendar.
• Learn Vedic astrology: free guides to charts, nakshatras and planets.