New GhostAction Attack Compromises 327 GitHub Users and 817 Repositories

Security researchers uncovered a campaign now identified as GhostAction that compromised secrets belonging to 327 GitHub users and affected 817 repositories. The attack began with a malicious workflow embedded in the FastUUID project and was first spotted when GitGuardian detected a suspicious workflow commit titled “Add Github Actions Security workflow” pushed by the account Grommash9 on 2 September 2025.

The injected file exfiltrated the repository’s PyPI API token to an attacker‑controlled server, leading researchers to flag multiple repositories with identical malicious commits across both public and private projects. According to GitGuardian, the campaign involved 3,325 leaked secrets, including GitHub tokens, DockerHub credentials, Cloudflare API tokens and NPM access keys, with some of the stolen data actively exploited such as AWS keys and database credentials.

Of the 817 repositories impacted, 100 reverted the changes, while 573 maintainers were warned, though some repositories had already been deleted or disabled. PyPI placed the compromised FastUUID project in read‑only mode, and the maintainer rolled back the malicious commit, helping to limit impact on FastUUID and its dependents.