Socket links GitHub workflow attack to credential theft

Security researchers at Socket have disclosed a new software supply chain attack that has compromised tens of thousands of GitHub repositories. The incident mirrors the GhostAction campaign seen in late 2025 and 2026, and involves two GitHub accounts, “henrywoo” and “kitao”, pushing a malicious GitHub Actions workflow to numerous repositories on 8 October 2026.

The file, named “.github/workflows/security-audit.yml”, was inserted via a routine‑seeming single‑file commit such as “Add security audit workflow” or “Update security audit workflow”, but it instead exfiltrates credentials from affected repositories to an external server at 193.32.204[.]199 over HTTP.

The attack targets repositories where the two accounts have write access, including henrywoo/pyllama, henrywoo/chatllama, kitao/pixel and uber/athenadriver, with activity extending to inactive projects as well, suggesting automated enumeration rather than targeted selection, according to Socket.

The campaign has expanded the GhostAction capability beyond merely harvesting secrets stored in GitHub Actions to also search repository files and complete Git histories for credentials using regular‑expression patterns. This means credentials for cloud providers and AI services could be exposed, potentially enabling abuse of infrastructure and third‑party services.

By 9 October 2026, the malicious workflow remained on default branches of examined repositories such as uber/athenadriver and kitao/pyxel, and some executions had already occurred, though Socket reported no evidence of malicious package versions published to PyPI or crates[.]io at that time. The report attributes the findings to Socket researchers and notes the continuing activity as of the stated dates.