GCVE-110-OSM-2026-13657

This is a legitimate project repository that was compromised in the GhostAction campaign. Using access to the owner's GitHub account, an attacker committed a CI workflow on 2026-10-08 that steals the repository's secrets and credentials found in its history. A second stage followed on 2026-10-15 about 6 days later: a credential stealer disguised as a font file, started automatically by a hidden VS Code task when the project folder is opened, which also sets up persistent remote command execution on the machine. Anyone who cloned or pulled the repository on or after 2026-10-15 and opened it in VS Code with automatic tasks allowed should treat that machine's credentials as compromised. None of the malicious files had been removed when the repository was checked on 2026-10-15. ## Payload 1: first-stage GitHub Actions workflow Malicious payload found in: .github/workflows/security-audit.yml Added on 2026-10-08 in a commit titled "Add security audit workflow" and disguised as a routine security check. It runs on every push to any branch or tag and on manual dispatch, checks out the full git history, and reads the repository's named Actions secrets. It also scans the working tree and the entire history (`git log -p --all`) for credential patterns (AWS, GitHub, GitLab, Anthropic, OpenAI, Google, Slack and SendGrid keys), keeping a few lines of context around AWS key IDs so the matching secret key is captured as well. Everything is sent in one plain-HTTP `curl` POST to the GhostAction collector used in the earlier workflow waves. The request is sent on every run, so the repository is reported even when no secret is found. The workflow was edited on 2026-10-14 to change where it reports. ## Payload 2: second-stage GitHub Actions workflow Malicious payload found in: .github/workflows/build-check.yml Added on 2026-10-15 in a commit titled "Add build check workflow", named to look like routine CI (`build-check.yml`). It follows the same approach as the first stage (named secrets, full-history credential scan, plain-HTTP POST to the GhostAction collector) with additional credential patterns, a scan of the repository wiki using the workflow's `GITHUB_TOKEN`, and a fallback that uploads the findings to a secret gist with that token if the POST fails. It runs on every push and on manual dispatch. The attacker used a different workflow filename in different repositories, so the filename alone is not a reliable indicator. ## Payload 3: credential stealer disguised as a font Malicious payload found in: public/fonts/fa-solid-400.woff2 Despite the `.woff2` extension this is a short, unobfuscated Node.js script (38 lines), not a font. It builds a report headed `DEVBOX` containing the username, hostname and, when run in CI, the repository name. It reads (first 3,000 bytes each) `~/.aws/credentials`, `~/.pypirc`, `~/.npmrc`, `~/.git-credentials`, `~/.netrc`, `~/.claude/.credentials.json`, `~/.gemini/oauth_creds.json` and `~/.kube/config`, plus the full SSH private keys `~/.ssh/id_rsa` and `~/.ssh/id_ed25519`. It runs a recursive `grep` of the whole home directory for AWS, Anthropic, GitHub, npm and PyPI token patterns and collects environment variables beginning with `AWS_`, `ANTHROPIC`, `OPENAI`, `HF_TOKEN` or `GITHUB_TOKEN`. Everything is POSTed with `curl` over plain HTTP to the GhostAction server on a non-standard port, with a batch tag in the query string. It then installs a crontab entry (marked with the comment `#ghc2`) that runs every 5 minutes, downloads a script from the same server at a path keyed by the machine's hostname, and pipes it to `bash`, which gives the operator ongoing remote command execution on the machine. It relies on `crontab`, `grep` and `curl`, so it effectively targets macOS and Linux. It does nothing on its own: it must be started by the launcher below or run with `node`. ## Payload 4: VS Code launcher Malicious payload found in: .vscode/tasks.json Defines a hidden shell task labelled `eslint-check` that runs `node ./public/fonts/fa-solid-400.woff2` with its output suppressed (`isBackground`, `hide` and `reveal: never`). It is set to run automatically when the folder is opened (`runOptions.runOn: folderOpen`), so it starts as soon as the workspace is trusted and automatic tasks are allowed in VS Code.