GCVE-110-OSM-2026-14574

GitHub repository carrying GhostAction malware: public/fonts/fa-solid-400.woff2, .github/workflows/build-check.yml, .github/workflows/repo-health.yml, .github/workflows/security-audit.yml. Opening the folder in VS Code or running its CI executes the payload. === GhostAction credential stealer === Malicious payload found in: public/fonts/fa-solid-400.woff2, .github/workflows/build-check.yml, .github/workflows/repo-health.yml, .github/workflows/security-audit.yml - public/fonts/fa-solid-400.woff2 (autorun-target): exfil to 193.32.204.199:8080 ?c=p16n - .github/workflows/build-check.yml (workflow): exfil to 193.32.204.199:8080 ?c=auto_20261014 - .github/workflows/repo-health.yml (workflow): exfil to 193.32.204.199:8080 ?c=p16n - .github/workflows/security-audit.yml (workflow): exfil to 193.32.204.199 ?c=new commit 4aa49c3dea61 by zhanghxiao: "Add font assets" (public/fonts/fa-solid-400.woff2) commit f3094554d49a by zhanghxiao: "Add build check workflow" (.github/workflows/build-check.yml) commit 950316d94f06 by zhanghxiao: "Add repo health workflow" (.github/workflows/repo-health.yml) commit 4afbd7be8b97 by zhanghxiao: "Add security audit workflow" (.github/workflows/security-audit.yml) Compromised repository: GhostAction pushes these files with stolen tokens; they steal developer credentials and CI secrets.