GhostAction variant steals secrets via workflows in tens of thousands of GitHub repos
Original title: New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositories
Accounts henrywoo and kitao added the workflow on October 8; it exfiltrates secrets over HTTP and scans Git history.
Socket researchers found a GhostAction variant that added a GitHub Actions workflow, .github/workflows/security-audit.yml, to tens of thousands of repositories, including organization-owned projects such as Uber’s uber/athenadriver. The accounts henrywoo and kitao pushed it on October 8, 2026, in commits framed as routine security-audit updates. The workflow sends stolen credentials to 193.32.204.199 over HTTP and also regex-scans files and full Git history for cloud and AI secrets. As of October 9 it remained on examined default branches and had executed; Socket had not seen follow-on malicious releases on PyPI or crates.io.
Unconfirmed: Socket had not seen malicious PyPI or crates.io releases and does not know whether stolen credentials were used elsewhere.
- Commit messages were “Add security audit workflow” and “Update security audit workflow.”
- Earlier GhostAction mainly took Actions secrets; this build also searches Git history.
- Named repos include henrywoo/pyllama, henrywoo/chatllama, kitao/pixel and uber/athenadriver.
- Repos inactive for a decade were changed, which Socket reads as automated enumeration.
- kitao/pixel is normally distributed through PyPI and crates.io.
Impact: Repository secrets and historical credentials sent to an external server
- 1.Remove .github/workflows/security-audit.yml from affected default branches
- 2.Rotate credentials the workflow could read, including secrets later deleted from history
- 3.Review repositories writable by the accounts henrywoo or kitao
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1552.001 Credentials In FilesT1048 Exfiltration Over Alternative Protocol
- Products
- GitHub Actions
- Threat actors
- GhostAction
- Victims
- Uber
- Organizations
- SocketGitGuardian
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | crates.io | bserved any malicious package versions published to PyPI or crates.io as a result of the campaign at the time the Socket report w |
| ipv4 | 193.32.204.199 | fected repositories and sends them to an external server at 193.32.204[.]199 over HTTP. Because the workflow looks like a legitimate s |
From the original article
2 min read at infosecurity-magazine.com
Security researchers have detected a malicious workflow affecting tens of thousands of GitHub repositories, including Uber-owned ones
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.