Provenance Record

News, 1,148 words by the script count (1,141 after stripping link syntax), under the 1,200 News ceiling and above the 400 floor. Structure is Overview, a counts section that keeps each vendor's and outlet's figure separate, delivery, rotation, bot accounts, an explicit 'What is not established' section, and advice. Figures are consistently labelled as the sources' own and the article states that they count different things at different times and should not be added or compared. The 1,806 versus 1,835 discrepancy inside Aikido's page is reported with both numbers and explicitly left unreconciled, which is the correct handling under Claim accuracy rule 6.

All four snapshots (source-0..3.html.gz) read from disk; sha256 of each decompressed snapshot matches manifest.json; HTTP 200, no archive fallback, suspicious_patterns null for all four. Each URL was also fetched live as raw text with a browser User-Agent on 2026-11-12: Aikido, StepSecurity and Help Net Security text identical to the snapshot; The Hacker News differs only by one stray '-->' token, and its Correction note is present in both. Every quoted string in the body was searched verbatim (whitespace and quote-normalised) in the snapshots and found in the source the article attributes it to; none is a paraphrase inside quote marks. (1) NOV 10 START: Aikido (source-0) says 'Starting on November 10' and 'approximately 12:45 UTC on November 10' (its PR search window opens 12:45 UTC on November 10); THN quotes SafeDep from 12:46 UTC Tuesday (Tuesday = November 10, 2026); StepSecurity (source-1) says 'Starting on November 10, 2026' and its sample table dates the first HTTP copies to November 10; Help Net Security says 'since November 10'. Headline and summary hold; the UTC basis is Aikido's and SafeDep's, StepSecurity and Help Net Security give no time zone. 'Their counts differ' holds: Aikido 4,837 accounts / 61,764 repositories / 61,839 search-result PRs (window 12:45 UTC Nov 10 to 15:00 UTC Nov 11) versus StepSecurity more than 63,000 PRs at 07:40 UTC Nov 12; Aikido 92% versus StepSecurity about 90% open; Aikido 1,806 versus 1,835 on its own page. (2) INDEPENDENCE: counted by outlet, 2 independent outlets and 2 security-vendor primary sources. The Hacker News adds reporting beyond Aikido: SafeDep's separate analysis (8,093 repositories, 7,309 / 771 split, Telegram in about a fifth of 200 sampled commits), its own check of three PRs opened 05:04-05:38 UTC, the Packagist listing date and malware notice, and a correction note. Help Net Security only restates Aikido's findings (every figure and claim in it is Aikido's; it adds nothing from its own checking) and the article does not claim otherwise. THN correction note ('Correction (November 12, 2026): ... A second analysis found a third server, a Telegram channel, and changes left in place for longer') read in snapshot and live; the article does not carry the superseded THN text ('only by HTTP POST to two addresses', 'reverted each change within a minute') as THN's claim: it attributes 'only by HTTP POST' to Aikido and cites THN only for the corrected 'changes left in place for longer' and for numbers/statements still in the corrected text. (3) COUNTS: Aikido page says both 'at least 1,835 repositories ran the payload' (summary bullet) and 'indications that the payload ran in at least 1,806 repositories' (body) - confirmed, article reports both. 10,431 is 'of the pull requests ... went into repositories the account doesn't own' (Aikido), and Aikido's next sentence '92% of them are still open' follows it; THN reads it as 92% of those 10,431 ('92% of those were still open when the company checked'); Help Net Security writes 'Ninety-two percent of the probe pull requests are still open' (all probe PRs); StepSecurity says 'about 90% of them still open' of its more than 63,000 probe PRs. All four attributions in the article match. (4) CLEANUP: Aikido 'reverts within at most one minute and deletes the workflow run, along with its logs'; StepSecurity 'usually within a minute'; StepSecurity's nextcloud/docker case: run #2675 ran three seconds after the commit and was never deleted, and 'A Nextcloud developer reverted the commit 27 minutes later' (the revert was the developer's, not the actor's) - the article's phrase 'a Nextcloud run that survived until a developer reverted the commit 27 minutes later' is imprecise on this point (see corrections). (5) STATUS CHECKS: Aikido (Persist) lists forged success status checks; Help Net Security 'It forges passing status checks to clear branch protection'; StepSecurity 'Fake passing checks (built in, not used yet)' and 'None of the 101 copies we examined had this turned on'. The article wording matches. (6) EXFILTRATION: Aikido 'configured to send data only by HTTP POST to 194.150.166[.]244:8080/exfil or 18.143.168[.]96:8080/exfil'; StepSecurity table: HTTP from November 10 (57 copies: 54 + 3), HTTP plus Telegram from November 12 01:10 UTC with third server 153.75.82[.]159 (1 copy), Telegram only from about 05:30 UTC (43 copies, all samples 07:00-07:40 UTC); UTC dates in the article match. (7) SAFEDEP: safedep.io is not cited and not in the allowlist; the article states the figures are reported by The Hacker News ('The Hacker News reports that SafeDep ... counted 8,093 repositories'), including the window and the default-branch-only scope; it never implies the Herald read SafeDep. SafeDep's separate advice and findings are not used. (8) ABSENCE CLAIM 'None of the four cited sources reports a statement from GitHub or Fly.io': grepped all four snapshots for statement/spokesperson/declined/reached out/responded and for every Fly.io and GitHub-as-speaker occurrence; Fly.io appears only in StepSecurity (technical attribution from GitHub API records, 'We are sharing our findings with Fly.io', no Fly.io reply); GitHub appears only as the platform; none carries a statement. Claim holds. 'No cited source says how the credentials were obtained' holds: Aikido silent (THN: 'does not explain'), StepSecurity 'We have not established how the tokens were obtained', Help Net Security silent, THN silent. (9) ROTATION: Aikido 'designed to outlast credential rotation' covers the AWS trust-policy rewrite and Azure federated credentials ('even after every token has been rotated'), and also lists the forged status checks under that heading; StepSecurity 'Remove the persistence, because rotation alone does not'; Help Net Security 'The AWS trust policy change and the Azure federated credentials survive secret rotation. Each one has to be tracked down and removed in every cloud account'; THN 'Some of its steps are built to survive credential rotation'. Article's wording matches. (10) INTERNAL LINK: /article/2026-10/10-stepsecurity-says-ghostaction-pushed-credential-stealing-workflows-to-345-repositories-via-two-hijacked-maintainer-accounts-on-october-8 exists (src/content/articles/2026-10/10-...md). Its corrections record concerns Socket's date and a 'summarizing tool' statement; the new article restates neither. Packages: digitalelvis/neuronai-studio 3.14.3, docker-env v1.0.278 / v1.0.280 match Aikido and Help Net Security; THN Wednesday = November 11. WebdriverIO: 28 repositories, wdio-bot, no package release affected in StepSecurity and THN. Anthropic disclosure: not required - the article never names Anthropic or Claude (it says only 'credentials for AI providers'); the sources name 'Anthropic/Claude' only as one entry in a list of AI-provider credentials the stealer collects, which the policy treats as an incidental name in a list. Allowlist: aikido.dev, stepsecurity.io, thehackernews.com, helpnetsecurity.com all already allowlisted; no additions.

Headline, summary and the first two sentences of the Overview are backed by the cited sources with the vendors named as speakers. Two subordinate incompleteness points and one imprecise sentence are filed as clarifications: (a) the Overview repeats Aikido's 'tens of thousands of repositories' for the payload without StepSecurity's own scoping that the stealer was pushed in 'thousands of repositories rather than all 63,000' probe PRs, and THN/SafeDep's 8,093; (b) the probe-PR comparison sets Aikido's 61,764 repositories against StepSecurity's 63,000 PRs and omits Aikido's own like-for-like 61,839 PRs (window to 15:00 UTC November 11); (c) the Nextcloud sentence blurs that the run was never deleted and that the 27-minute revert was a Nextcloud developer's. Nothing wrong in the headline, summary or lead as attributed. Minor wording note not filed: 'hidden script' for Aikido's .ci-xxxxxx.sh is StepSecurity's word, and the article uses it in a sentence attributed to Aikido; the file is dot-prefixed, so it is not misleading.

Accurate, carefully attributed news report on an active multi-vendor-reported CI secret-theft campaign, with disagreements between sources shown rather than reconciled. Approved with a corrections record of three clarifications (lead scope, probe-count comparability, Nextcloud cleanup wording); none touches the headline or summary. Featured candidacy: 2 - an active campaign touching tens of thousands of repositories that anyone with GitHub write access can check for, with actionable indicators, though the cited counts remain vendor-reported and moving.