GitHub Workflows Attack Affects Hundreds of Repos, Thousands of Secrets

A supply chain attack dubbed GhostAction has targeted GitHub Action workflows, with SecurityWeek reporting that it affected hundreds of repositories and thousands of secrets. The campaign came to light after the GitHub account of the FastUUID project maintainer was compromised on 2 September, allowing a malicious workflow file to be added and secrets harvested.

According to GitGuardian, the operation involved 327 GitHub users and 817 repositories, with more than 3,300 secrets leaked, including DockerHub credentials, GitHub tokens, and NPM tokens. Initial discussions with affected developers confirmed that attackers were actively exploiting stolen secrets such as AWS access keys and database credentials, and several companies saw their SDK portfolios compromised across Python, Rust, JavaScript, and Go repositories.

Security teams have warned that many of the impacted repos reverted the malicious changes, and ongoing surveillance is being kept on package registries to ensure tokens are not misused. according to GitGuardian, 9 NPM and 15 PyPI packages are at risk of compromise in the next hours or days, underscoring the scale of the GhostAction campaign.