Jeff R jeff-r-skillrev

wfx-loot audit: check your GitHub access for the Nov 2026 CI secret stealer

On Nov 10, 2026, stolen GitHub credentials were used to push a CI secret stealer (wfx-loot) into a large number of repositories. It reverts its commits and deletes its workflow runs within about a minute, so looking at main won't show you anything.

wfx_audit.py checks every repo your account can reach (personal, collaborator and org-member repos) for the traces that cleanup leaves behind. It only reads: it never writes to GitHub.

Run it

Needs Python 3.8+ and nothing else. Works on Windows, macOS and Linux.

	import { TextField } from '@mui/material';
	import { useRef } from 'react';

	export default function TextFieldExt(props) {
	const { type } = props;
	const noStupidWheelScroll = type === 'number';
	const thisTextField = useRef(null);
	const noOnWheelFn = (wheelEv) => {
	wheelEv.preventDefault();
	};

	import * as excel4node from 'excel4node';

	// https://stackoverflow.com/questions/48643025/sheetjs-repaired-records-worksheet-properties-from-xl-workbook-xml-part-work
	const main = () => {
	const myWb = new excel4node.Workbook();
	const longNameWs = myWb.addWorksheet(
	'This is more than thirty-one characters'
	);
	longNameWs.cell(1, 1).string('Just a value');
	myWb.write('temp.xlsx');

	/* Purpose
	Firebase needs certain rewrite rules in place, in order to function properly with
	Next.js' static routing. This only applies to statically generated Next.js
	projects (i.e. built by 'next build' 'next export')

	Inspired by the discussion at:
	https://github.com/firebase/firebase-js-sdk/discussions/4980

	*/

	# See this URL for more details 🚨
	# https://traefik.io/blog/how-to-force-update-lets-encrypt-certificates/?utm_campaign=Let%27s%20Encrypt%20Issue&utm_medium=email&_hsmi=202062799&_hsenc=p2ANqtz-84m7OPEeg9o4xkToQefSLny16r8DkAl9NHEdv7C4z91iNvLF9rRqqKTD1DbTr-cCSGvx4QO9oNzdG0w7WHd0s-adhSoLZ4e1PsO8jcvT0WMOEPpSU&utm_content=202062799&utm_source=hs_email

	# if there is no output, you are probably good to go 👍
	kubectl get pod --all-namespaces -l app.kubernetes.io/name=traefik -o wide \| grep traefik \
	\| awk '{ print $1, $2 }' \| xargs -n2 bash -c 'kubectl describe -n $0 pod $1' \
	\| grep tlsChallenge

	### Keybase proof

	I hereby claim:

	* I am jeff-r-koyaltech on github.
	* I am kubectl_apply (https://keybase.io/kubectl_apply) on keybase.
	* I have a public key ASBYqmJeWa5M4j1KqUhbWoLRxVVIlwvrOz_YQ0sRT-HOFgo

	To claim this, I am signing this object:

	// example:
	// curl -X POST -H 'Content-Type: application/json' http://localhost:4000/stripe/customers/byCard \
	// --data '{ "email": "user@host.com", "last4": "4242", "exp_month": 4, "exp_year":"22" }' \| jq


	const util = require('util')

	let stripe_key = process.env.STRIPE_SK
	let stripe = require('stripe')(stripe_key)

	<?xml version="1.0" encoding="utf-8"?>
	<Package xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10" xmlns:mp="http://schemas.microsoft.com/appx/2014/phone/manifest" xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10" IgnorableNamespaces="uap mp">
	<Identity Version="0.5.0.0" Name="39705SimonDieterle.TextSecure" Publisher="CN=D7D38CBF-3113-497A-88DB-52B717888A39" />
	<mp:PhoneIdentity PhoneProductId="baaa3ed2-1f3a-4a86-91aa-b9c7c296e913" PhonePublisherId="043dd04d-998e-43b5-9450-82637d90e0a8" />
	<Properties>
	<DisplayName>TextSecure</DisplayName>
	<PublisherDisplayName>Simon Dieterle</PublisherDisplayName>
	<Logo>Assets\StoreLogo.png</Logo>
	</Properties>
	<Dependencies>

	<Package ...>
	<!-- ... blah blah blah ... -->
	<Extensions>
	<Extension Category="windows.activatableClass.inProcessServer">
	<InProcessServer>
	<Path>curve25519.dll</Path>
	<ActivatableClass ActivatableClassId="curve25519.Curve25519Native" ThreadingModel="both" />
	</InProcessServer>
	</Extension>
	</Extensions>

	PM> Install-Package Google.ProtocolBuffers
	Install-Package : Unable to find package 'Google.ProtocolBuffers'
	At line:1 char:1
	+ Install-Package Google.ProtocolBuffers
	+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	+ CategoryInfo : NotSpecified: (:) [Install-Package], Exception
	+ FullyQualifiedErrorId : NuGetCmdletUnhandledException,NuGet.PackageManagement.PowerShellCmdlets.InstallPackageCommand

	PM> Get-Package -ListAvailable