A second surge of the credential-theft campaign pushed malicious workflows across 28,000 repositories in about twenty minutes.