Security researchers at Socket have uncovered a new software supply chain attack that has affected tens of thousands of GitHub repositories, including organization-owned ones.

Uber is mentioned as one of the businesses that runs compromised packages.
The kill chain is reminiscent of GhostAction, a malicious campaign discovered by GitGuardian in September 2025 and reappeared in October 2026.

Malicious Workflow Spread Via Two GitHub Accounts

On October 8, 2026, two GitHub accounts, ‘henrywoo’ and ‘kitao,’ pushed a malicious GitHub Actions workflow to hundreds of repositories they had permission to modify.

A GitHub Action is an automated task that runs in a GitHub repository to handle activities such as testing code, building software or deploying applications whenever specific events occur.

The workflow, named “.github/workflows/security-audit.yml,” was added through a single-file commit designed to look routine, “Add security audit workflow” and “Update security audit workflow.”

Despite its name, the workflow does not perform any security checks. Instead, it steals credentials from affected repositories and sends them to an external server at 193.32.204[.]199 over HTTP.

Because the workflow looks like a legitimate security tool, it can go unnoticed while running as part of the repository's automated processes.

According to Socket researchers, the malicious file was found in tens of thousands of repositories, which include ones where ‘henrywoo’ or ‘kitao’ have write access.

Infection vectors include the following repositories:

• henrywoo/pyllama and henrywoo/chatllama, AI GitHub projects created by ‘henrywoo’
• kitao/pixel, typically distributed through both Python Pacjkage Index (PyPI) and crates.io, online repositories where developers publish and distribute software packages written in Python and Rust, respectively
• uber/athenadriver, an Uber-owned project where ‘henrywoo’ has write access as its original author

Even repositories that had been inactive for a decade were affected, suggesting the attackers systematically enumerated every repository they could access instead of choosing targets based on their activity or value.

The activity appears automated rather than manually targeted.

Expanding GhostAction’s Secret Theft Capabilities

While the incident is a new variation of the GhostAction campaign, Socket researchers noted that this latest version expands what the attackers can steal.

Earlier GhostAction attacks primarily targeted secrets stored in GitHub Actions, such as API keys and access tokens configured for automated workflows.

The new variant also searches the repository's files and complete Git history for credentials using regular-expression patterns. This means it can find sensitive information that developers accidentally committed to source code, configuration files or earlier versions of files, even if those credentials have since been deleted from the latest version of the repository.

The additional search targets credentials for cloud providers and AI services, potentially exposing access to infrastructure, hosted applications and third-party services.

Malicious Workflow Still Active in GitHub Repositories

As of October 9, 2026, Socket reported that the malicious workflow was still present on the default branches of the repositories it examined, including uber/athenadriver and kitao/pyxel.

The workflow had also successfully executed in affected repositories, meaning the credential-stealing activity was not limited to an attempted injection.

However, the researchers had not observed any malicious package versions published to PyPI or crates.io as a result of the campaign at the time the Socket report was published.

This does not mean the stolen credentials have not been used for other purposes, only that Socket had not identified evidence of follow-on malicious package releases on those two registries.

Image credits: Poetra.RH / PJ McDonnell / Shutterstock.com