Dustmaker lifts GitHub Actions tokens so its packages clear AI coding trust checks

GTIG says Dustmaker extracts tokens from the process memory of GitHub Actions runners, then uses them to publish compromised versions of packages ^[7]. The publish therefore comes from the project's own automation, under the project's own identity, which is why the automated trust checks applied by AI coding workflows return valid ^[7]. Those checks verify who published, not what changed.

The second technique goes at the review surface. GTIG reports Dustmaker dropping or modifying malicious files inside hidden project workspace directories used by AI coding assistants, where the activity blends into developer noise and evades detection ^[8]. Together the two techniques defeat both provenance checks and manual inspection ^[17].

The causal claim about AI-assisted development is GTIG's assessment, and it is hedged in GTIG's own wording: faster development has "likely" reduced scrutiny of third-party packages and dependencies ^[4]. No measurement accompanies it. What is countable is supply. LLM adoption in production has increased the volume of open-source resources built for AI use cases, MCP servers among them ^[3], and GTIG ties the change in development practice to several large-scale supply chain compromises across 2025 and early 2026 ^[2].

UNC6780 sells what it takes. After initial access it collects credentials to AI tools and passes them to other criminal groups ^[9]. Separately in the same report, GTIG describes a command and control server hosting an offensive reconnaissance framework called Recon whose exposed directory became a live production dashboard organising and validating more than 23,800 harvested secrets, including cloud and AI service API keys ^[15]. GTIG does not connect the two operations, though both point to the same demand: API keys, at volume.

GTIG expects copying, and says so directly: the publicity, apparent success and open-source release of UNC6780's malware will likely spur adversary emulation of the tactics ^[10]. The release is the operative detail, because the technique now costs a download rather than a development cycle. Against that, the reporting names ecosystems and techniques but no packages, versions or victim counts ^[18], so an operator has no list to diff installs against and is left checking publishing paths instead of artefacts.

The rest of the quarter's material shows what the stolen material is worth to buyers. GTIG tracks UNC6508, a Chinese nation-state actor, targeting proprietary AI research at academic, medical and military institutions in North America ^[11]. It also counts multiple extortion operations that stole models, skills, prompts, source code and research from technology, healthcare, pharmaceutical and media companies in North America and Europe, then threatened publication ^[12]. Targeting reached past frontier labs into government, military and healthcare users of AI ^[13].

For anyone publishing to a registry out of CI, the failed control here is the assumption that a pipeline identity stays trustworthy for the duration of a build ^[7].