D1337: Cryptomining in Other People's GitHub Actions

On 30 October 2026, 55 repositories under 28 accounts still carried the D1337 mining configuration at their pinned default-branch commit. The earlier discovery set, checked on 29 October, contained 58 repositories under 31 accounts.

The workflow named "CI Build" is configured to download XMRig every six hours and mine for 345 minutes, paying into one wallet and labeling each worker with the repository owner's name. These are configured actions; workflow runs were not checked.

• Thirty of the accounts are old, unrelated developer accounts. The thirty-first is a bot account created on 7 February 2026, whose identity, "D1337 Bot", signs many of the planting commits.
• All 58 repositories were still public on 29 October 2026. On 30 October, 55 of them still had the miner configuration at their current commit; in 3 it was no longer found.
• I found no public report of this cluster, its wallet or its bot identity.

Nothing was executed, and I did not contact the mining pool. The workflow files were read through GitHub code search. Owners are treated as victims and are not named.

The proven set was closed on 1 November 2026 with what had been found up to 31 October 2026, 17:59 UTC; repositories found after that are tracked separately and are not in these figures. The full proof pass at pinned commits ran on 30–31 October. On 1 November 2026, 18:23 UTC a read-only GitHub API recheck covered the 162 repositories, 73 accounts and 12 issues that are tracked one by one (operator repositories, Shai-Hulud accounts, phishing issues), not the whole set.

• Frozen: 55 repositories under 28 accounts proven by the workflow file; three more carry the cluster's commits but not the file at the pinned commit.
• State: all 58 repositories public on 1 November, none with a commit since 29 October.

While triaging general malware found by code search, a workflow that downloads a miner stood out. I pivoted on its payout wallet with code search, and on the author name of its commits with commit search.

Because the binary is the genuine XMRig release, a file-hash check will not catch it. The configuration does.

• Many repositories have generic names such as ci-pipeline, build-pipeline-<number>, deploy-pipeline or test-runner, created inside the victims' accounts.
• 34 of the 58 core repositories have no "D1337 Bot" commit. They are in the core because they contain the wallet, so their workflows were committed by other identities at dates I do not have.
• On 23 May 2026, between 02:59 and 03:16 UTC, fourteen core repositories were pushed, thirteen of them belonging to one owner. That looks like a second planting round under another identity.

A separate account with four repositories mines to a different wallet through the same pool. It also owns six of the core repositories, so its role is unresolved.

Three core repositories were pushed again between 14 and 19 October 2026.

1. Look for repositories you did not create, especially names like ci-pipeline or build-pipeline-123.
2. Grep every workflow for xmrig, unmineable, randomx and stratum.
3. Revoke personal access tokens and OAuth or app tokens, and review your account's security log.
4. Require signed commits or push rules, so unexpected identities stand out or are blocked.
5. GitHub disables scheduled workflows in public repositories after 60 days without activity, so many of these schedules are probably off already. A single push re-arms the miner.

• Whether the workflows ran, and what was earned, was not checked.
• Planting identity and dates are unknown for 34 of the 58 repositories.
• Code search sees default branches only, so the counts are a floor.
• How the accounts were accessed is not established.

This article is part of the GitHub threat investigation. Counts are a snapshot, not evidence that the code ran on a victim's machine. The shared methodology and proof rules explain inclusion, exclusions and the independent re-check.