A workflow file that looks like a routine security check is turning up in thousands of GitHub repositories. It is not a check. According to security firm Socket, it quietly sends the repository’s secrets to a server controlled by the attacker.
Socket said that as of 9 October it had identified more than 500 GitHub accounts that committed the malicious workflow to tens of thousands of repositories since 7 October. The activity is a renewed wave of a campaign researchers call GhostAction. The earlier wave was reported by The Hacker News and others.
How the attack works
The attackers take over the account of a maintainer, then use that account’s write access. According to Cybersecurity News, once an attacker can write to a repository, they can add a GitHub Actions workflow to every repository the account can modify.
The planted files are named “security-audit.yml” or “github_actions_security.yml”. The commit messages are bland, such as “Add security audit workflow”. The Hacker News reports that the workflow runs on a manual trigger or on any push, to any branch or tag.
When it runs, it sends data over plain HTTP to a hard-coded IP address, 193.32.204[.]199, according to researchers cited by The Hacker News.
What it takes
The first GhostAction wave focused on secrets stored in GitHub Actions. This version reaches further. According to StepSecurity, as quoted by The Hacker News, the workflow also scans the working tree and the full git history for 13 credential patterns. That means keys a developer committed by mistake and later deleted can still be found.
The targets include AWS keys, API keys for Anthropic, OpenAI and OpenRouter, and GitHub and GitLab tokens. Cybersecurity News adds that package-publishing credentials for PyPI, crates.io and similar registries are also in scope.
Those last items carry the greatest risk beyond the victims themselves. A stolen publishing token could let an attacker push a poisoned update of a trusted library, which would then reach everyone who installs it.
Who has been hit
StepSecurity said the attacker used the account of Takashi Kitao, author of the game engine pyxel, which has about 18,400 stars. From 13:20 UTC the attacker pushed the workflow to 27 of his repositories. Cybersecurity News also lists Uber’s athenadriver repository among the targets.
It also reports 318 affected repositories under the henrywoo namespace, 279 of them forks. Commits landed in short bursts, including in projects that had been untouched for years. Researchers read that as automated discovery, not hand-picked targets. Socket says the affected set includes several organisation-owned repositories reached through compromised contributors.
The figures are researcher counts, not a GitHub tally. Exact numbers may change as the investigation continues. The articles reviewed do not say how the maintainer accounts were first compromised.
What to do now
- Search your repositories for files named security-audit.yml or github_actions_security.yml in the .github/workflows folder, and for commits you did not make.
- Check logs and network rules for any traffic to 193.32.204[.]199.
- Rotate secrets if you find the file: Actions secrets, cloud keys, AI API keys and publishing tokens. Do the same for anything that ever sat in the git history, because deleting a commit does not make a key safe.
- Secure your account. Use a hardware key or passkey, review active sessions and personal access tokens, and remove those you do not recognise.
- Limit blast radius. Use short-lived, narrowly scoped tokens, require reviews for changes under .github/workflows, and restrict who can push to default branches.
- Audit releases. If a publishing token was exposed, check recent package versions for changes you did not make.
For ordinary users of open-source software, there is little to do directly. Maintainers and package registries carry the response. Keeping dependencies pinned and watching for advisories from the projects you rely on is a sensible habit.
Researchers describe the campaign as active, so the list of affected projects is likely to grow.