Fake 'Security Audit' Workflow Found in Tens of Thousands of GitHub Repositories

Security researchers at Socket have uncovered a new software supply chain attack affecting tens of thousands of GitHub repositories, including ones owned by organisations. Uber is mentioned as one of the businesses that runs compromised packages. The attack resembles GhostAction, a campaign GitGuardian discovered in September 2025, which the source says reappeared in October 2026.

On October 8, 2026, two GitHub accounts, 'henrywoo' and 'kitao,' pushed a malicious workflow file named "security-audit.yml" to hundreds of repositories they had permission to modify. The commits were labelled "Add security audit workflow" and "Update security audit workflow" so they looked routine. Despite the name, the workflow performs no security checks. It steals credentials and sends them over HTTP to an external server. Because it resembles a legitimate security tool, it can run unnoticed as part of a repository's automated processes. Even repositories inactive for a decade were affected, and the activity appears automated rather than manually targeted.

This version expands what attackers can steal. Earlier GhostAction attacks mainly targeted secrets stored in GitHub Actions, such as API keys and access tokens. The new variant also searches repository files and the full Git history for credentials using pattern matching. That means passwords or keys accidentally committed in the past can be found even if they were later deleted from the current version of the code.