GhostAction steals GitHub Actions secrets from your old commits
A supply-chain campaign hijacked two maintainer accounts to push a fake security-audit workflow that mines full git history, including deleted secrets, from hundreds of repositories.
On 8 October, attackers compromised two high-profile GitHub maintainer accounts and pushed a workflow called security-audit.yml into hundreds of repositories. StepSecurity, tracking the campaign under the name GhostAction, says the account of Takashi Kitao, who maintains the 18,400-star pyxel game engine, pushed the workflow to 27 repositories between 13:20 and 13:44 UTC. The account of Henry Wu, original author of Uber’s athenadriver, pushed it to 318 more, including Uber’s own repository, between 21:10 and 21:26 UTC.
The workflow does more than grab named Actions secrets. It runs git log -p --all against the full repository history, so it reaches credentials that were committed and later deleted, not just ones still configured today. It searches for thirteen credential patterns, including AWS keys, Anthropic, OpenAI and OpenRouter API keys, and GitHub and GitLab tokens, then posts everything it finds to a hardcoded IP address over plain HTTP.
Why it matters: rotating a leaked secret does not retire it if a copy is still sitting in an old commit. If you maintain anything on GitHub, check your Actions workflows for anything unfamiliar added since late August, and turn on secret scanning with push protection so a credential in a diff gets caught before it is ever committed.
The caveat: StepSecurity counted 378 repositories still carrying the workflow on 9 October; Socket put the figure at 346. Both are tracking the same live campaign as it spreads, so treat the scale as approximate, not final.