GhostAction returns: hijacked maintainer accounts push secret-stealing "security-audit.yml" workflow into hundreds of repos
The workflow runs on push and harvests CI/CD and cloud secrets from whole git histories, so any repository or fork that received it since 8 October has already leaked long-lived tokens that attackers can use for downstream package and image publishing this week.
On 8 October 2026 the GhostAction operators took over two high-profile open-source maintainer accounts — Takashi Kitao (pyxel, 18.4k stars) and Henry Wu/henrywoo (original author of Uber's athenadriver) — and in two automated bursts committed a malicious GitHub Actions workflow to 345 repositories (27 repos from 13:20 UTC, then 318 repos in 16 minutes, 21:10–21:26 UTC). The fake "security audit" workflow exfiltrates GitHub Actions secrets, cloud credentials and secrets mined from the entire git history of each repository; as of 9 October Socket counted more than 500 GitHub accounts that committed the workflow across tens of thousands of repositories.
Affected: Repositories under the compromised accounts Takashi Kitao (pyxel author) — 27 repositories pushed from 13:20 UTC 2026-10-08; Repositories under henrywoo (athenadriver author) — 318 repositories pushed 21:10–21:26 UTC 2026-10-08; Any repository containing an attacker-added .github/workflows/security-audit.yml (500+ accounts, tens of thousands of repos per Socket)
How to Test
Search every org and personal repository (including forks and archived repos) for commits added since 2026-10-08 that create or modify a workflow named security-audit.yml or any workflow that reads ${{ secrets.* }} / iterates git history and POSTs to an external host; cross-check the GitHub Actions run history and the org audit log (repo.add_member, workflows.* , git push events) for runs of such a workflow and for pushes attributed to the compromised maintainer accounts, and review cloud provider logs for use of CI credentials from unfamiliar IPs after that date.
How to Mitigate
Delete the malicious workflow and any attacker commits, then rotate every secret the workflow could reach — repository and organization Actions secrets, OIDC-less static cloud keys, registry/publish tokens (npm, PyPI, Docker), signing keys and any credential ever committed to git history — revoke PATs, SSH keys and OAuth/GitHub App grants on the affected maintainer accounts, enforce hardware MFA plus required reviews on workflow changes, and pin/limit GITHUB_TOKEN permissions to read-only by default.