A software supply-chain campaign known as GhostAction has targeted more than 30,000 GitHub repositories, exposing weaknesses in developer account security and automated software workflows.
The campaign, which intensified between October 8 and 12, 2026, used compromised maintainer accounts to introduce malicious GitHub Actions workflows disguised as security checks.
According to GitGuardian’s investigation, the attackers targeted repositories associated with approximately 3,000 users and organisations after compromising about 1,900 GitHub accounts.
The researchers identified attempts to extract 3,174 secrets from public repositories’ continuous integration environments.
Those figures describe the campaign’s reach and attempted credential theft, not confirmation that every targeted repository suffered successful data exfiltration.
Fake Security Audits Conceal Credential Theft
Security company Socket documented an October 8 operation involving two compromised GitHub accounts, identified as henrywoo and kitao.
The accounts introduced a malicious file named security-audit.yml into 346 repositories through routine-looking commits.
In its technical analysis, Socket identified 318 affected repositories under the henrywoo namespace, 27 under kitao, and Uber’s athenadriver repository, where the compromised contributor had write access.
The attack also affected the popular kitao/pyxel project, which had approximately 18,420 GitHub stars and 966 forks at the time of Socket’s investigation.
Rather than performing security checks, the injected workflow collected credentials and attempted to transmit them to an attacker-controlled server.
The payload targeted GitHub Actions secrets and scanned repository files and historical commits for credentials associated with cloud and AI services.
These included AWS credentials, GitHub and GitLab access tokens, and API keys associated with services such as Anthropic, OpenAI and OpenRouter.
Attackers Expanded Their Reach Across GitHub
The latest wave builds on earlier GhostAction operations documented by GitGuardian security researchers Gaetan Ferry and Guillaume Valadon.
Their investigation found that the campaign had previously affected 772 public repositories between August 31 and September 30, targeting 2,577 secrets.
The October campaign introduced more extensive scanning capabilities, allowing the malicious workflow to examine historical commits even when credentials were no longer visible in current files.
GitGuardian recorded a major deployment affecting approximately 28,000 new repositories between October 8 and 9.
The researchers reported that GitHub began preventing the malicious workflows from executing on October 9, blocking credential extraction during subsequent waves observed on October 10 and 12.
Socket said it had not observed malicious package versions published to PyPI or crates.io as a result of the activity at the time of its investigation.
Developer Access Becomes a Critical Security Weakness
The campaign demonstrates how a compromised maintainer account can threaten projects beyond those owned directly by the affected developer.
Contributors with access to organisation-owned repositories may inadvertently provide attackers with an entry point into business software infrastructure.
Socket’s recommended response measures include removing malicious workflows, rotating exposed credentials, revoking compromised account access and examining repository histories for previously committed secrets.
Security teams were also advised to review GitHub Actions execution logs, enforce stronger authentication and enable secret scanning with push protection.
For developers and technology companies, GhostAction illustrates why protecting source code alone is insufficient.
Software development increasingly depends on automated workflows, cloud services and interconnected credentials. Those systems can improve productivity but also expand the consequences of a single compromised account.
The broader security lesson is that the trust assigned to software maintainers and automation pipelines must be continuously verified, especially as development environments become more interconnected.
