GCVE-110-OSM-2026-14230

This repository was compromised by the GhostAction campaign. An attacker using the owner's GitHub access pushed malicious files directly to it. It received a workflow that searches the repository and its git history for credentials and sends them to the attacker's server (added October 7, 2026). The workflow runs on pushes and sends what it finds when GitHub lets it run. ## Payload 1: workflow that searches the repository and its history for credentials Malicious payload found in: `.github/workflows/security-audit.yml` First pushed October 8, 2026. Updated 1 time afterwards. A GitHub Actions workflow named like a security check. It runs on every push and on manual dispatch, checks out the full git history, searches the working tree and every commit (`git log -p --all`) for credential patterns (AWS, Anthropic, OpenAI, GitHub, Google, Slack and similar), and sends any matches with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 80 or 8080, with a batch tag in the query string. It installs nothing. ## Payload 2: second workflow that searches the repository, its history and its wiki Malicious payload found in: `.github/workflows/lint.yml`, `.github/workflows/test-suite.yml` First pushed October 15, 2026. Updated 1 time afterwards. A GitHub Actions workflow that runs on every push and on manual dispatch. It checks out the full git history, searches the working tree, every commit (`git log -p --all`) and the repository's wiki (cloned with the job's `GITHUB_TOKEN`) for credential patterns, and sends the result with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080 with a batch tag. If that request fails it creates a private gist containing the same data through the GitHub API using `GITHUB_TOKEN`. Many versions also add named repository secrets (`${{ secrets.NAME }}`) to the upload. The attacker used a different file name and display name in different repositories. It installs nothing. ## Payload 3: workflow that sends named repository secrets Malicious payload found in: `.github/workflows/github_actions_security.yml` First pushed October 7, 2026. Updated 1 time afterwards. A small GitHub Actions workflow (job `send-secrets`, step `Prepare Cache Busting`, the same names as the 2025 GhostAction workflow) that runs on every push and on manual dispatch and sends a list of named repository secrets (`NAME=${{ secrets.NAME }}`) with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 80 or 8080, with a batch tag on later versions. The secret names differ from repository to repository. It does not search the repository or its history and installs nothing.