The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
InfoNews
New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
- Published
- Record updated
Summary
Two compromised GitHub maintainer accounts, henrywoo and kitao, committed a workflow named security-audit.yml to 346 repositories on October 8, 2026, including the Uber-owned uber/athenadriver and kitao/pyxel. The workflow collects GitHub Actions secrets and, in addition, scans the working tree and full git history for cloud provider and AI service credentials, posting them to a hardcoded IP address. Socket reports the file remained on default branches as of October 9, 2026, and that the workflow has run successfully in affected repositories.