Starting December 1, 2023, GitHub started upgrading the Linux and Windows Action runners to 4-vCPU virtual machines with 16 GiB of memory, doubling their previous capacity.

That code dumps the memory of the Github runner process, looks for anything there tagged with isSecret, and writes those values out to the log.

GitHub Actions is an automated CI/CD platform that integrates with GitHub to create seamless, versatile CI/CD pipelines. Here's how it works.

The GitHub Actions runner agent itself, or rather another instance of it that’s not linked to the PyTorch organization but to a GitHub organization controlled by the attackers.

That code dumps the memory of the Github runner process, looks for anything there tagged with isSecret, and writes those values out to the log.