Socket published an update on 9 October to its tracking of GhostAction, a campaign that commits credential-stealing workflows to GitHub repositories. The current wave started on 7 October.

The file is .github/workflows/security-audit.yml. It is committed directly to the default branch, with a message like "Add security audit workflow". It runs on push, with no branch or path restrictions, and can also be triggered by hand.

It does not audit anything.

The part that is actually clever

A GitHub Actions workflow can only read the secrets it names. A generic payload that asks for AWS_ACCESS_KEY_ID gets nothing from a repository that calls the same thing something else.

So before deploying, the attackers read the repository's existing workflows to find which Action secrets it references, and wrote those names into the payload.

That is a small step and it changes the economics. It turns one reusable template into something effective against repositories with arbitrary naming conventions, and it means the yield per compromised repository is close to everything that repository had.

The October variant adds a sweep of its own: a regex hunt for cloud-provider and AI-service credentials committed into the repository and its complete git history. Secrets that were removed in a later commit are still in the history, and the attackers know it.

The targets named in reporting run to SSH private keys, AWS, Azure, Google Cloud and Firebase, DockerHub and GHCR, database and FTP credentials, GitHub tokens, Cloudflare, npm, PyPI, and AI provider keys.

How many, and how to read the number

Here the reporting needs separating from the research, as it did with the FakeGit repository count.

What Socket says it observed: 318 repositories under one account namespace, 279 of which are forks, plus 27 under another, plus Uber's athenadriver.

What has been widely reported: more than 500 accounts and tens of thousands of repositories.

Those are not the same claim, and the forks explain the gap. A fork is a copy. One compromised account forking a few hundred repositories and committing to each produces a very large repository count and a very small number of distinct victims. Counting the fork as a separate compromise inflates the figure without adding a stolen secret.

The 500-account figure comes mainly from secondary coverage of Socket's update. GitGuardian's earlier count — 772 repositories across 373 users and organisations between 31 August and 30 September — is a separate wave, not a subset.

None of which makes the campaign small. It makes the headline number a measure of commits rather than of victims.

The organisation exposure

The detail with the widest reach is athenadriver sitting under Uber's organisation.

Socket's account is that contributor permissions carried an individual account compromise into organisation-owned projects. The attackers did not need to compromise Uber. They needed to compromise somebody who could commit to one of its repositories.

That is the structural lesson, and it is not new — it is just rarely priced in. An organisation's repository security includes every outside contributor's personal account hygiene, and there is no mechanism by which the organisation can observe or improve that.

As of 9 October the workflow file was still present on the default branches Socket checked, including Uber's.

What Socket does not know

Two gaps are worth stating because they are load-bearing.

Socket did not determine how the maintainer credentials were obtained. Without that, nobody can say whether the fix is rotating tokens, enforcing hardware keys, or finding an upstream compromise that is still running.

Socket also says it observed no malicious package versions published to PyPI or crates.io as a result. That is the outcome everyone fears from stolen publishing tokens, and so far it has not happened — which could mean the credentials have not been used yet, or are being sold, or that the operation is only collecting.

What to do

  • Search your repositories for security-audit.yml and for commits adding it. The message is bland and the filename is designed to survive a glance.
  • Rotate anything a workflow could have read. Not only what you think it needed — what the workflow named.
  • Then rotate anything that was ever committed, including in history you have since rewritten or force-pushed over. That is the new part.
  • For organisations: audit outside contributor permissions, and require hardware-backed authentication for anyone who can push to a default branch.
  • Protect default branches so a workflow file cannot be added by a direct commit.

What is not established

  • How the maintainer accounts were taken.
  • The true number of distinct compromised accounts, as distinct from affected repository counts inflated by forks.
  • Whether the stolen credentials have been used, beyond the absence of malicious package publishing.
  • Whether this wave and the August to September wave are the same operator. The tooling matches; attribution is not claimed.
  • How many of the credentials swept out of git history were still valid.