Supply-chain attacksBriefConfirmed by two or more outlets
GhostAction resurgence
GitGuardian (31 Aug to 30 Sep): 772 repos, 373 owners, 2,577 secrets.
- Disclosed
What happened
- 9 Oct: the pyxel and henrywoo accounts pushed workflows to 345 repos in 16 minutes.
- Socket: 500+ accounts, “tens of thousands” of repos. Workflow file names: `security-audit.yml` and `github_actions_security.yml`.
Sources
- https://thehackernews.com/2026/10/credential-stealing-github-actions.html
- https://blog.gitguardian.com/ghostaction-campaign-3-325-secrets-stolen/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.