New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositories
A sophisticated supply chain attack has compromised tens of thousands of GitHub repositories, including those owned by Uber, by injecting malicious workflows that steal credentials.
Security researchers at Socket have uncovered a widespread supply chain attack that has impacted tens of thousands of GitHub repositories, including those belonging to major organizations like Uber. The attack, which began on October 8, 2026, involves two malicious GitHub accounts, 'henrywoo' and 'kitao,' which pushed a malicious workflow file named '.github/workflows/security-audit.yml' to numerous repositories.
This workflow, despite its innocuous name suggesting a security audit, does not perform any security checks. Instead, it is designed to exfiltrate sensitive credentials, such as API keys and access tokens, from affected repositories and send them to an external server located at 193.32.204[.]199. The malicious file was added through commits with seemingly routine messages like "Add security audit workflow" and "Update security audit workflow," making it difficult to detect at a glance.
The attackers appear to have systematically targeted repositories where the compromised accounts had write access, including inactive ones, indicating an automated and broad approach rather than a targeted one. Notable affected repositories include 'henrywoo/pyllama' and 'henrywoo/chatllama,' AI projects created by one of the malicious accounts, as well as 'kitao/pixel,' a project distributed via PyPI and crates.io. Critically, Uber's 'uber/athenadriver' project was also compromised, as 'henrywoo' was an original author with write access.
This campaign bears resemblance to the 'GhostAction' malicious campaign previously identified by GitGuardian in September 2025 and which resurfaced in October 2026. However, this new iteration significantly expands the capabilities of the credential theft. Previous GhostAction variants primarily focused on stealing secrets stored within GitHub Actions configurations. The current variant goes further by scanning the entire repository, including its Git history, for credentials embedded within source code, configuration files, and even deleted files using regular expressions.
The expanded scope of the attack means that sensitive information accidentally committed by developers, even if later removed from the main branch, can still be harvested. The attackers are specifically targeting credentials for cloud providers and AI services, potentially granting them access to critical infrastructure, hosted applications, and third-party services.
As of October 9, 2026, Socket researchers confirmed that the malicious workflow remained active on the default branches of affected repositories, including 'uber/athenadriver' and 'kitao/pyxel.' Furthermore, the workflow had successfully executed in these repositories, confirming that the credential-stealing activity was not merely an attempted injection but an active compromise.
While Socket had not observed any malicious package versions being published to PyPI or crates.io as a direct result of this campaign at the time of their report, the stolen credentials could still be leveraged for other malicious purposes. The full extent of the impact and how the stolen credentials might be used remains an ongoing investigation.
This incident underscores the persistent and evolving threat of supply chain attacks targeting code repositories. The attackers' ability to blend malicious code with legitimate-looking workflows and to expand their data exfiltration capabilities highlights the need for continuous vigilance and advanced security measures within development pipelines.