GCVE-110-OSM-2026-14654

GitHub repository carrying GhostAction malware: public/fonts/fa-solid-400.woff2, .github/workflows/code-review.yml, .github/workflows/repo-health.yml, .github/workflows/security-audit.yml. Opening the folder in VS Code or running its CI executes the payload. === GhostAction credential stealer === Malicious payload found in: public/fonts/fa-solid-400.woff2, .github/workflows/code-review.yml, .github/workflows/repo-health.yml, .github/workflows/security-audit.yml - public/fonts/fa-solid-400.woff2 (autorun-target): exfil to 193.32.204.199:8080 ?c=p16n - .github/workflows/code-review.yml (workflow): exfil to 193.32.204.199:8080 ?c=p16n - .github/workflows/repo-health.yml (workflow): exfil to 193.32.204.199:8080 ?c=auto_20261014 - .github/workflows/security-audit.yml (workflow): exfil to 193.32.204.199 ?c=new commit 0a4fecf5ff18 by zhanghxiao: "Add font assets" (public/fonts/fa-solid-400.woff2) commit 64ea8995060c by zhanghxiao: "Add code review workflow" (.github/workflows/code-review.yml) commit d6c71aa58ba6 by zhanghxiao: "Add repo health workflow" (.github/workflows/repo-health.yml) commit f21c73f26a29 by zhanghxiao: "Add security audit workflow" (.github/workflows/security-audit.yml) Compromised repository: GhostAction pushes these files with stolen tokens; they steal developer credentials and CI secrets.