GhostAction supply-chain attack hijacks 340+ GitHub repos via two maintainer accounts

A renewed wave of the GhostAction supply-chain attack compromised two well-known open-source maintainer accounts on October 8, 2026, and used their push access to plant a credential-stealing GitHub Actions workflow in more than 340 repositories within minutes, according to research published by StepSecurity.

The first account belonged to the developer of the pyxel game engine, a project with roughly 18,400 GitHub stars. It was used to push the malicious workflow to 27 repositories between 13:20 and 13:44 UTC. Eight hours later, a second compromised account — belonging to the original author of Uber's open-source athenadriver library — pushed the same workflow to 318 repositories, including 39 source projects and 279 forks, in a single 16-minute window. The access reached into Uber's own GitHub organization before the company could intervene.

GitHub Actions workflows have become a favored target for supply-chain attackers because a single compromised maintainer account can silently inject malicious automation into every repository that account can write to, and that automation then runs with the trust and credentials already configured for the project. The original GhostAction campaign, identified in September 2025, stole more than 3,300 secrets from 817 repositories tied to 327 developers. This second wave reused the same playbook at a larger scale and against higher-profile targets.

The injected files — named security-audit.yml and an older variant called github_actions_security.yml — were disguised as routine security-scanning jobs. Once triggered, they combed both the working tree and the full git history, including deleted files, for 13 categories of credentials: AWS access keys and session tokens, Anthropic, OpenAI and OpenRouter API keys, GitHub and GitLab tokens, Google and Firebase keys, Slack bot tokens, and SendGrid credentials. They also harvested specific named secrets already configured in each repository's workflows, such as PyPI and Cargo publishing tokens. Everything found was posted in cleartext to a hardcoded command-and-control server.

As of October 9, StepSecurity found 378 repositories still carrying the live malicious workflow on their default branch, with confirmed evidence that named secrets had been exfiltrated from at least 88 of them. No malicious package releases tied to the stolen publishing credentials had surfaced by the time the research was published, but the firm warned that any repository showing a completed run of the workflow should be treated as a confirmed breach.

The incident is a reminder that open-source trust runs through individual maintainer accounts rather than organizations: Uber's own repository was touched not because Uber was targeted directly, but because one external contributor's compromised credentials happened to reach it. StepSecurity is urging anyone who maintains affected projects to rotate every credential ever committed to any branch — since the attack's history-mining step reads secrets that were deleted long ago — revoke the compromised sessions, remove the workflow from every branch and fork, and require pull-request review before any change to a repository's .github/workflows directory.