An ongoing credential-theft campaign has compromised two high-profile open-source maintainer accounts on GitHub. Attackers pushed malicious workflows into over 340 repositories, including one belonging to the author of the popular Pyxel game engine. These malicious GitHub Actions workflows are designed to steal credentials, posing a significant supply chain risk for projects that depend on these repositories. This incident highlights the vulnerability of open-source ecosystems to account compromise and malicious code injection.