GCVE-110-OSM-2026-14258

This repository was compromised by the GhostAction campaign. An attacker using the owner's GitHub access pushed malicious files directly to it. It received a workflow that searches the repository and its git history for credentials and sends them to the attacker's server (added October 8, 2026) and a credential stealer disguised as a font file and a hidden VS Code task that runs it when the folder is opened (added October 15, 2026). Anyone who opened the project in VS Code with automatic tasks allowed after October 15, 2026 should treat that machine's credentials as compromised, because the stealer also installs a scheduled job that runs commands from the attacker's server every five minutes. ## Payload 1: workflow that searches the repository and its history for credentials Malicious payload found in: `.github/workflows/security-audit.yml` First pushed October 8, 2026. A GitHub Actions workflow named like a security check. It runs on every push and on manual dispatch, checks out the full git history, searches the working tree and every commit (`git log -p --all`) for credential patterns (AWS, Anthropic, OpenAI, GitHub, Google, Slack and similar), and sends any matches with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 80 or 8080, with a batch tag in the query string. It installs nothing. ## Payload 2: second workflow that searches the repository, its history and its wiki Malicious payload found in: `.github/workflows/audit.yml`, `.github/workflows/build-check.yml`, `.github/workflows/ci-check.yml`, `.github/workflows/test-suite.yml` First pushed October 15, 2026. Updated 3 times afterwards. A GitHub Actions workflow that runs on every push and on manual dispatch. It checks out the full git history, searches the working tree, every commit (`git log -p --all`) and the repository's wiki (cloned with the job's `GITHUB_TOKEN`) for credential patterns, and sends the result with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080 with a batch tag. If that request fails it creates a private gist containing the same data through the GitHub API using `GITHUB_TOKEN`. Many versions also add named repository secrets (`${{ secrets.NAME }}`) to the upload. The attacker used a different file name and display name in different repositories. It installs nothing. ## Payload 3: credential stealer disguised as a font file Malicious payload found in: `public/fonts/fa-solid-400.woff2` First pushed October 15, 2026. Despite the `.woff2` extension this is a short, unobfuscated Node.js script. When run it reads the first 3,000 bytes of `~/.aws/credentials`, `~/.pypirc`, `~/.npmrc`, `~/.git-credentials`, `~/.netrc`, `~/.claude/.credentials.json`, `~/.gemini/oauth_creds.json` and `~/.kube/config`, and the SSH private keys `id_rsa` and `id_ed25519` in full. It runs a recursive `grep` of the home directory for AWS, Anthropic, GitHub, npm and PyPI token patterns and collects environment variables whose names begin with `AWS_`, `ANTHROPIC`, `OPENAI`, `HF_TOKEN`, `GITHUB_TOKEN`, `_API_KEY` or `_TOKEN`. Everything is sent with `curl` over plain HTTP to 193[.]32[.]204[.]199 on port 8080, with a batch tag in the query string. It then installs a crontab entry, marked `#ghc2`, that every five minutes downloads a script from the same server at a path built from the `$HOSTNAME` variable and pipes it to `bash`, which gives the operator remote command execution. The file does nothing on its own: it runs when the VS Code task below, or `node`, executes it. ## Payload 4: VS Code launcher Malicious payload found in: `.vscode/tasks.json` First pushed October 15, 2026. Defines a hidden shell task labelled `eslint-check` that runs the file `public/fonts/fa-solid-400.woff2` with `node` only if `node` is installed (`command -v node` on macOS and Linux, `where node` on Windows), and does nothing otherwise. It is set to run automatically when the folder is opened (`runOptions.runOn: folderOpen`), so it starts as soon as the workspace is trusted and automatic tasks are allowed in VS Code. The task sends nothing and installs nothing itself.