Malicious wfx-loot npm package steals GitHub Actions secrets

published 2026-11-14

The wfx-loot package contains a malicious workflow and a hook that runs during package setup, working as a GitHub Actions secret stealer. An attacker gets the secrets and tokens readable on the machine or in the affected repositories.

Source: @SiuHarry202601 on X

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 3376 and your operating system.