GhostAction: The Phantom Hack That Raided 3,325 Secrets from Open Source

Fast Facts

• GhostAction attack compromised 817 GitHub repositories, affecting 327 developers.
• Attackers stole over 3,325 secrets-including API tokens, credentials, and publishing keys.
• Malicious code was hidden in GitHub Actions workflows, exfiltrating data to external servers.
• Projects in Python, JavaScript, Rust, and Go were targeted; some SDK portfolios fully tampered with.
• Incident detected and reported by GitGuardian; security teams across GitHub, npm, and PyPI are still investigating.

A Ghost in the Code: How the Attack Unfolded

On a quiet September morning in 2025, a seemingly routine automation script landed in the FastUUID project-a library that helps software generate unique IDs. But beneath its familiar name, “Github Actions Security,” lurked something far more sinister. According to GitGuardian, reported via HackRead, this script was actually a covert data thief, quietly packaging up sensitive secrets and shipping them off to an external server.

The breach was first detected when security researchers noticed unusual network activity: secrets, including PyPI tokens and DockerHub credentials, were being siphoned away from the project in the background. As the investigation widened, it became clear FastUUID was just the tip of the iceberg. Hundreds of other projects-spanning languages from Python to Go-had quietly fallen victim to nearly identical attacks.

Supply Chain Shadows: A New Kind of Open Source Risk

The GhostAction campaign follows a troubling trend: attackers targeting the very tools developers trust to build and distribute software. By sneaking malicious code into GitHub Actions workflows-automated scripts that run in the cloud whenever code changes-attackers effectively weaponized the software supply chain itself. It’s reminiscent of past incidents like the SolarWinds hack, where trusted update mechanisms became the attackers’ trojan horse.

What set GhostAction apart was its surgical precision. The attackers analyzed legitimate workflow files, adapting their malicious script to mimic the exact secrets each project used. Each attack was personalized, like a tailor-made skeleton key for every repository. The stolen secrets ranged from private API keys to publishing tokens for npm and PyPI, opening the door to further attacks-like hijacking software releases or accessing cloud infrastructure.

The campaign’s scale is sobering. According to GitGuardian’s detailed report, over 3,325 secrets were exfiltrated from 817 repositories. Some companies found their entire SDK portfolios compromised. While no malicious package releases were confirmed during the attack window, the potential for downstream abuse remains high-especially since some tokens are still at risk.

Wider Ripples: The Market and Geopolitical Angle

The GhostAction attack underscores a growing market and security dilemma for open source software. As more companies depend on community-driven code, the risks of supply chain attacks multiply-potentially impacting everything from cloud services to critical infrastructure. Security vendors like GitGuardian and platforms like GitHub are now racing to improve detection and limit fallout, but the incident reveals how a single compromised workflow can echo across the digital landscape.

With attackers leveraging automation and cloud-native tools, the line between trusted contributor and malicious actor is blurrier than ever. As the investigation continues, the GhostAction breach stands as a stark warning: in open source, even a ghost of a vulnerability can haunt thousands.

WIKICROOK

• GitHub Actions Workflow: GitHub Actions Workflows are automated scripts that run on GitHub when code changes, commonly used for testing, building, or deploying software.
• Supply Chain Attack: A supply chain attack is a cyberattack that compromises trusted software or hardware providers, spreading malware or vulnerabilities to many organizations at once.
• CI/CD Secrets: CI/CD secrets are sensitive credentials, like API keys or tokens, used by automated systems to securely build and deploy software in DevOps pipelines.
• PyPI Token: A PyPI token is a secure password used by developers to upload Python packages to the PyPI repository. If compromised, it can allow malicious uploads.
• Indicators of Compromise (IoCs): Indicators of Compromise (IoCs) are clues like filenames, IPs, or code fragments that help detect if a computer system has been breached.