New Software Supply Chain Attack Exposed by Security Researchers
In a significant security breach, researchers at Socket have unveiled a new software supply chain attack that has compromised tens of thousands of GitHub repositories, including those owned by organizations. This alarming development highlights inherent vulnerabilities within popular software development platforms.
Among the numerous businesses affected, Uber has emerged as a notable entity running compromised packages. This attack echoes the tactics of previous campaigns, particularly a series called GhostAction, which was initially discovered by GitGuardian back in September 2025 and later reappeared in October 2026.
Malicious Workflow Propagation via GitHub Accounts
On October 8, 2026, two GitHub accounts, known as ‘henrywoo’ and ‘kitao,’ pushed a pernicious GitHub Actions workflow to hundreds of repositories that they had permissions to alter. A GitHub Action is designed to execute automated tasks within a repository, performing functions like testing code, building software, or deploying applications in response to specific events.
The malicious workflow, labeled as “.github/workflows/security-audit.yml,” was introduced through a single-file commit that appeared innocuous, with descriptions such as “Add security audit workflow” or “Update security audit workflow.” However, beneath this false pretense, the workflow does not conduct any security checks as its name might suggest. Instead, it silently harvests credentials from the affected repositories, transmitting them to an external server located at 193.32.204[.]199 using an unencrypted HTTP connection.
Due to its legitimate appearance as a security tool, the malicious workflow often evades detection while functioning within the routine operations of the repository. Researchers from Socket observed that this malicious file infiltrated tens of thousands of repositories, particularly those where the two accounts—‘henrywoo’ or ‘kitao’—possessed write access.
Infection vectors identified in the report include prominent repositories such as:
- henrywoo/pyllama and henrywoo/chatllama: Both of these are AI-focused projects owned by ‘henrywoo.’
- kitao/pixel: This repository is typically distributed through popular package managers Python Package Index (PyPI) and crates.io, platforms where software developers publish and share their creations.
- uber/athenadriver: This is an Uber-owned project where ‘henrywoo’ is the original author and possesses write access.
Interestingly, vulnerabilities were found even in repositories that had been inactive for close to a decade, suggesting a systematic approach by the attackers who indiscriminately enumerated every repository they could access, rather than selecting targets based solely on their current activity levels or perceived value. This characteristic indicates that the attack was largely automated rather than a product of targeted manual efforts.
Enhancement of GhostAction’s Secret Theft Capabilities
While this incident represents a new chapter in the GhostAction campaign saga, researchers at Socket have noted that it expands the scope of what attackers can potentially extract. Previously, GhostAction attacks primarily focused on secrets within GitHub Actions—namely, API keys and access tokens configured for automated workflows.
In contrast, this contemporary variant extends its reach by probing the repository’s files and comprehensive Git history for additional credentials using regular expression patterns. This capability allows the discovery of sensitive data that developers might have inadvertently committed to the source code or configuration files, irrespective of whether those credentials are still in the latest version of the repository. Consequently, this poses a heightened risk, as it could uncover access to infrastructure, hosted applications, and third-party services, thereby amplifying the threat landscape.
Ongoing Presence of Malicious Workflow in GitHub Repositories
As of October 9, 2026, researchers at Socket confirmed that the malicious workflow remains active within the default branches of affected repositories, including uber/athenadriver and kitao/pyxel. Not only had the workflow infiltrated these repositories, but it had also successfully executed credential-stealing activities, indicating that the injection was not merely an attempted breach.
However, the researchers did not report any malicious package versions being published to PyPI or crates.io as a result of this campaign at the time of their analysis. Though this lack of identifiable post-attack activity does not necessarily imply that the stolen credentials haven’t been exploited for nefarious purposes, it does suggest that there hadn’t been any immediate evidence of malicious package releases on the noted registries.
This incident exemplifies critical concerns regarding software supply chain security and highlights the need for robust protections against similar attacks in the future. As organizations continue to leverage services like GitHub, understanding such vulnerabilities and actively mitigating risks will be essential in securing the integrity of software development processes.
Image credits: Poetra.RH / PJ McDonnell / Shutterstock.com