A recent GhostAction campaign has infiltrated hundreds of GitHub repositories, exploiting two compromised maintainer accounts to introduce a deceptive “security audit” workflow. This tactic, aimed at extracting CI/CD secrets, cloud keys, and credentials from source-code history, has affected 346 repositories.
Details of the GhostAction Campaign
Security firm Socket identified that the breach occurred on October 8, involving repositories associated with the GitHub accounts ‘henrywoo’ and ‘kitao.’ Notably, targets included Uber’s ‘uber/athenadriver’ and the widely used ‘kitao/pyxel’ project, which boasts over 18,000 stars on GitHub.
The fraudulent file, ‘.github/workflows/security-audit.yml,’ was introduced via commits labeled “Add security audit workflow” and “Update security audit workflow.” These changes highlight how a compromised GitHub maintainer account can jeopardize more than just a single repository.
Impact on Continuous Integration and Delivery
Once attackers obtained write access, the malicious workflow was added to each accessible repository, activating automatically when developers pushed code. This action placed sensitive CI/CD credentials within reach of the attacker. According to Socket’s investigation, the workflow transmitted stolen data via HTTP POST requests to 193.32.204[.]199.
The compromised workflow harvested secrets from GitHub Actions workflows, including PyPI passwords, GitHub tokens, and other credentials. Additionally, the GhostAction version scanned repository files and the complete Git history, searching for hardcoded secrets, a significant enhancement from previous iterations.
Preventive and Remedial Measures
Security researchers observed that the attack appeared highly automated, impacting 318 repositories under the ‘henrywoo’ namespace and 27 under ‘kitao,’ including many inactive for years. This suggests the use of automated tools for repository discovery.
In response, affected teams are advised to revoke GitHub sessions, personal access tokens, and all secrets mentioned in the workflow. They should review Git history, scrutinize GitHub Actions run records, and monitor network logs for suspicious activity. Implementing strict branch rules and least-privilege permissions can mitigate future risks.
As of October 9, no malicious packages have been published to platforms like PyPI or crates.io, but vigilance remains crucial. GitHub secret scanning and push protection can further safeguard against similar threats.
This breach emphasizes the ongoing vulnerability of CI/CD environments to supply-chain attacks, underscoring the importance of robust security measures for open-source projects.
