Malware · · 6 min read
Hijacked developer accounts are planting credential stealers on GitHub and npm
A campaign called GhostAction is using stolen GitHub logins to slip secret-stealing code into hundreds of projects. We’re following it as it develops.
What’s going on
GitHub Actions lets a project run automated jobs, like tests or releases, whenever code changes. Those jobs often hold “secrets”: tokens that can publish a package, deploy a website or reach a cloud account. GhostAction abuses that. With a maintainer’s stolen login, the attacker commits a workflow that looks like a security improvement. It runs on the next change and quietly posts the project’s secrets to a server the attacker controls.
The campaign isn’t new. GitGuardian first reported it in September 2025, when it hit 817 repositories across 327 GitHub users and exfiltrated at least 3,325 secrets. On October 7, 2026, GitGuardian said a new wave had pushed the workflow to 772 public repositories belonging to 373 users and organizations between August 31 and September 30, targeting 2,577 secrets. In that wave, GitHub held most runs for approval, so far fewer actually ran.
How the attacker gets the logins in the first place isn’t confirmed. StepSecurity says the most plausible source is a leaked access token from infostealer logs or credential dumps. GitGuardian adds that stolen GitHub credentials are traded and reused by several unrelated groups. That’s the link to everyday security: infostealers take saved logins and session tokens from ordinary computers, and some of those computers belong to developers.
Updates
Where things stand on Sunday
The most recent counts are from October 9. StepSecurity found 378 repositories with the malicious workflow still on their main branch, a number it expects to drift as owners clean up. Socket, StepSecurity and The Hacker News all reported that no malicious package versions had been published with the stolen PyPI or crates.io credentials at that point. StepSecurity cautions that this doesn’t mean those credentials are safe until they’re rotated. We’ll add an update when there’s solid new reporting.
Sources: StepSecurity, Socket, The Hacker News.
Socket: hundreds more accounts involved
Socket published its analysis of the October 8 burst, counting the workflow in 346 repositories, and found it had run successfully. In an update the same day, Socket said it had identified more than 500 GitHub accounts that committed the malicious workflow to tens of thousands of repositories since October 7. Later that day, GitGuardian added a note to its own report pointing to the new wave.
Sources: Socket, GitGuardian.
318 repositories in 16 minutes, including Uber’s athenadriver
The account of Henry Wu, the original author of Uber’s athenadriver, pushed the same workflow to 318 repositories between 14:10 and 14:26 PT: 39 of his own projects and 279 forks, ending with uber/athenadriver, which he could still write to. StepSecurity retrieved the run log for athenadriver and says the attacker’s server acknowledged receipt of the data four seconds after the job started.
Source: StepSecurity.
A popular game engine’s maintainer account is used first
Using the account of Takashi Kitao, author of the pyxel game engine (about 18,400 stars on GitHub), the attacker pushed the workflow to 27 repositories. In pyxel’s copy, the workflow named its PyPI and crates.io publishing credentials, the keys to releasing new versions of the library. StepSecurity says the attacker re-ran the job by hand twice after updating it.
This version does more than earlier waves. It reads the project’s full history and looks for 13 kinds of credentials, including AWS keys, AI-provider API keys and GitHub tokens, so a key committed once and deleted years ago is still exposed.
Sources: StepSecurity, Socket.
Separately: a hijacked npm package ships a credential-stealing worm
Version 0.5.144 of tensorlake, an npm package with about 12,000 weekly downloads, was published with malware that runs during installation. Socket flagged it 11 minutes later. It steals credentials such as npm and GitHub tokens, cloud keys and SSH keys, and uses stolen npm tokens to republish other packages. This is a different campaign from GhostAction (researchers link it to the Shai-Hulud family), but it targets the same thing: developer credentials.
GitHub’s advisory says any computer that installed it should be considered fully compromised. StepSecurity found it also plants a background job that deletes your home folder if the stolen GitHub token is revoked, so the order of clean-up matters (see below).
Sources: Socket, GitHub Advisory Database, StepSecurity.
If you maintain code on GitHub
- Look for the workflow. The files are
.github/workflows/security-audit.yml,github_actions_security.ymlorsecurity-check.yml, usually with the commit message “Add security audit workflow” or “Add Github Actions Security workflow”. StepSecurity says to treat any of them added since August 31, 2026 as a confirmed breach. - Remove it from every branch, and check your forks. It runs on a push to any branch.
- Revoke the GitHub login that was used, not just the repository’s secrets: sessions, personal access tokens, OAuth grants and SSH keys. Otherwise the same access can be used again.
- Rotate everything the history sweep could reach: every Actions secret, and every credential that was ever committed to the repository, even if it was later deleted.
- Require approval for workflow runs where you can. StepSecurity observed that setting stop an exfiltration attempt this week.
If you installed tensorlake 0.5.144, Thailand’s national CERT and StepSecurity both advise removing the gh-token-monitor job before revoking any GitHub token, then rotating credentials from a clean computer.
If you don’t write code
There’s nothing to change on your own devices because of this story. Two habits still help: keep a password manager and passkeys in place of saved browser passwords, and be wary of cracked software and “free” downloads, the usual route for infostealers.
Sources
- StepSecurity, GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories, October 9, 2026
- Socket, New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials, October 9, 2026
- GitGuardian, The campaign that never stopped: tracking GhostAction from 2025 to 2026, October 7, 2026 (updated October 9)
- The Hacker News, Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories, October 9, 2026
- Socket, TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack, October 8, 2026
- GitHub Advisory Database, Malware in tensorlake (GHSA-rqxj-g25x-4v9v), October 8, 2026
- StepSecurity, Tensorlake npm Package Compromised: A Worm With a Hostage Token, October 2026
- ThaiCERT, Supply Chain Attack Through Tensorlake npm Package Steals Credentials and Spreads Malware, October 9, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.