ACCORDING to GitGuardian, the GhostAction campaign is a massive supply chain attack that affected 327 GitHub users across 817 repositories, with malicious workflows exfiltrating 3,325 secrets such as PyPI, npm, and DockerHub tokens to an attacker-controlled endpoint. The discovery was made on 5 September 2025 by GitGuardian researchers Gaetan Ferry and Guillaume Valadon.
The attackers pushed malicious workflow files titled “Add Github Actions Security workflow,” which contained secret exfiltration code that executed on every push or manual trigger. GitGuardian notes that 100+ repositories had already reverted changes by disclosure time, highlighting the scale of compromise across multiple package ecosystems.
The exfiltration endpoint used in the campaign resolved to 45.139.104[.]115 at the domain bold-dhawan[.]45-139-104-115[.]plesk[.]page, with infrastructure described as disposable. The GhostAction campaign underscores the ongoing risk to CI/CD secrets and the need for proactive security measures in GitHub Actions workflows.