Major Open-Source Maintainer Accounts Compromised in Renewed "GhostAction" Supply Chain Attack Campaign

Cybersecurity researchers have issued urgent warnings regarding an ongoing, highly sophisticated credential-theft campaign that has successfully compromised high-profile open-source maintainer accounts to covertly inject malicious automated workflows into hundreds of software repositories.

The widespread activity represents a major escalation of the "GhostAction" supply chain attack framework, which first captured the attention of the global security community in late 2025. According to detailed disclosures from cybersecurity firms StepSecurity and Socket, the attackers leveraged compromised maintainer privileges to distribute unauthorized GitHub Actions workflows across thousands of downstream projects, placing an extensive array of cloud, AI, and SaaS infrastructure secrets at immediate risk of exfiltration.

The latest wave of attacks centers around the hijacking of trusted developer identities within the global open-source ecosystem. In the most recent incidents tracked by StepSecurity, the threat actors gained unauthorized access to the personal GitHub account of Takashi Kitao, the renowned author of the popular 18,400-star game engine Pyxel. Utilizing Kitao’s credentials, the attackers systematically pushed a malicious workflow file to 27 distinct repositories starting at 13:20 UTC.

Just eight hours later, the campaign struck a second high-profile target: the account of Henry Wu, recognized as the original author of Uber’s athenadriver project. The threat actors used Wu’s compromised account to inject the exact same malicious workflow into a staggering 318 repositories. This coordinated distribution occurred rapidly within a tightly compressed 16-minute window between 21:10 and 21:26 UTC, demonstrating a high degree of automation and operational efficiency by the attackers.

The scope of the broader campaign extends far beyond these two individual breaches. Security monitoring conducted by Socket revealed that by October 9, 2026, more than 500 distinct GitHub accounts had been identified as actively committing the malicious workflow to tens of thousands of repositories in a continuous wave that accelerated sharply beginning October 7.

These developments build upon earlier intelligence published earlier in the week by GitGuardian, which documented that the GhostAction campaign had previously pushed the identical malicious workflow to 772 public repositories belonging to 373 distinct GitHub users and organizations between August 31 and September 30, 2026.

The GhostAction campaign first emerged in September 2025, when researchers initially tracked its impact across 817 repositories managed by 327 GitHub users. That initial iteration successfully exfiltrated 3,325 sensitive secrets, including vital publishing tokens for major package registries such as PyPI, npm, and DockerHub, by exploiting compromised developer accounts.

In the current wave of attacks, the mechanics of the intrusion rely on deploying specially crafted GitHub Actions workflow files bearing innocuous-sounding names such as "Security Audit" ("security-audit.yml") or "GitHub Actions Security" ("github_actions_security.yml"). Once merged or synchronized into a target repository, these scripts are engineered to autonomously harvest and exfiltrate sensitive data over plain HTTP to a hard-coded external IP address, specifically identified as 193.32.204[.]199.

The scope of data targeted by these unauthorized workflows is exceptionally broad. According to technical analysis provided by StepSecurity and GitGuardian, the malicious scripts are designed to trigger automatically on workflow_dispatch events as well as unfiltered pushes across any branch or tag. The workflow checks out the repository with full history using a fetch-depth setting of zero, allowing the automated script to scan not just the active working tree, but the entire git history of the project for accidentally committed credentials.

The captured information encompasses an expansive list of critical authentication tokens and cryptographic secrets. Among the 2,577 distinct types of secrets targeted by the campaign are CI/CD credentials, SSH private keys, Azure service principal credentials, DockerHub and GitHub Container Registry (GHCR) tokens, database connection strings, AWS access keys, FTP configurations, Google Cloud and Firebase service account keys, and standard GitHub and GitLab access tokens. Furthermore, the workflows aggressively harvest API keys for major artificial intelligence and SaaS providers, including Anthropic, OpenAI, and OpenRouter, alongside messaging and collaboration bot tokens for Telegram, Slack, and Discord, as well as configuration keys for Cloudflare, npm, and PyPI.

In at least one particularly alarming instance observed on August 30, 2026, researchers documented that the threat actors went beyond mere credential harvesting. In that case, the attackers compromised the "kuafuai/DevOpsGPT" repository and actively altered the project’s source code and configuration to embed a malicious XMRig cryptocurrency miner directly into the project’s official Docker image. However, security analysts note that as of the time of reporting, no malicious package releases have been published to public registries using compromised publishing credentials from this latest wave, suggesting the primary objective remains widespread espionage and credential harvesting.

The architecture of the attack presents significant cascading risks for downstream users and contributors. Socket highlighted the severe danger posed by repository forks, noting that the 279 forks residing within the Henrywoo namespace each carry the unauthorized workflow file. If GitHub Actions are enabled on these secondary copies, subsequent code pushes can independently trigger credential harvesting operations. Furthermore, downstream forks remain perpetually vulnerable if they inherit the malicious workflow either upon creation or by synchronizing updates with an affected upstream repository.

Security experts emphasize that private forks and internal organizational mirrors represent the areas of highest exposure. Because private repositories are frequently where developers inadvertently commit sensitive internal credentials, cloud keys, and proprietary tokens, successful compromise of these private contexts yields a much higher concentration of valuable intelligence for the threat actors. Additionally, researchers noted that across both primary and secondary accounts, every executed workflow returns a distinct repository identifier back to the command and control infrastructure, regardless of whether any specific secrets were ultimately discovered. This mechanism ensures that the operators maintain an exhaustive, real-time map of reachable execution contexts independent of successful credential theft.

In response to the ongoing campaign, cybersecurity professionals and platform maintainers are urging all software developers and organizations to conduct immediate audits of their GitHub repositories. Specifically, teams are advised to inspect their codebase and configuration history for the presence of the unauthorized "security-audit.yml" or "github_actions_security.yml" workflow files introduced at any point since August 31, 2026.

Any organization or individual whose repository is found to contain the suspicious workflow must immediately treat the environment as fully compromised. Recommended remediation steps include revoking all compromised GitHub and third-party credentials, rotating associated cloud, API, and deployment secrets, permanently deleting the malicious workflow files from all active and historical branches, and thoroughly inspecting any forks or mirrors associated with the infected projects to prevent persistent, reinfection cycles across development pipelines.