🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

Hi @ChetanWorkspace,

This is a critical security emergency. Your GitHub account and machine have been actively compromised.

The screenshot showing an unauthorized "Force push" across your default branches means an attacker has active programmatic write access to your repositories. Because Git requires authentication to push code, this is not an external "exploit" attacking GitHub itself; it means your personal credentials have been exfiltrated or stolen.

This signature typically points to an InfoStealer malware infection on your local development machine or a compromised developer tool token loop. You must act immediately to stop the automated attacker script from doing further damage or altering production code.

Step 1: Terminate Session Tokens Immediately

Do not wait for support. Lock down your account from your GitHub settings right now:

• Revoke Personal Access Tokens (PATs): Go to Settings > Developer Settings > Personal Access Tokens (both Classic and Fine-Grained). Delete every single token you do not explicitly recognize, or clear them all out entirely to break external script access.
• Revoke SSH / GPG Keys: Go to Settings > SSH and GPG keys. Check for any unrecognized public keys and delete them instantly.
• Kill Active Browser Sessions: Go to Settings > Sessions. Click "Log out of all other sessions" to force disconnect any malicious active tokens or cookie-hijacking states.
• Check Authorized OAuth Apps: Go to Settings > Applications. Revoke access to any third-party app or development agent that has write access to your repositories.

Step 2: Quarantine Your Local Machine

If an InfoStealer (like RedLine or Lumma) is running on your machine, it will instantly harvest any new credentials or passwords you type.

• Disconnect Network Connection: Take the infected development machine completely offline.
• Run Deep Malware Scans: Use a dedicated, clean anti-malware suite to sweep your local storage, especially checking recent downloads, cracked software, or malicious extensions inside your IDE/browsers.
• Change Passwords From a Clean Device: Using a separate, secure device (like a smartphone or clean laptop), update your GitHub password and ensure your Two-Factor Authentication (2FA) is active and set up with an authenticator app (not just email).

Step 3: Recovering Your Default Branches

Once the attacker's write permissions are severed, you can undo the force-pushed commits by using the GitHub Reflog framework to find your original pre-attack commit hashes:

1. In your local repository terminal (once your machine is confirmed clean), type: git reflog
2. Locate the commit hash right before the attacker's "removed bug" force push.
3. Reset your local branch state back to that clean commit: git reset --hard <clean-commit-hash>
4. Force push your restored, clean history back up to your repository: git push origin main --force

Protect Your Repositories Moving Forward

To prevent an attacker from ever force-pushing over your main codebase again, even if they manage to compromise a developer token in the future:

• Navigate to your critical repositories and go to Settings > Rulesets (or Branches).
• Create a branch protection rule targeting your default branch (e.g., main or master).
• Strictly toggle on: "Block force pushes" and "Require a pull request before merging".