Tens of thousands of GitHub repositories contained a malicious automated workflow that stole credentials and sent them to an external server, security researchers at Socket reported.
Accounts 'henrywoo' and 'kitao' pushed the workflow on October 8, 2026
On October 8, 2026, two GitHub accounts — 'henrywoo' and 'kitao' — pushed a single-file commit adding a workflow to hundreds of repositories where those accounts had write permission, Socket researchers found. The commits used routine-sounding messages such as "Add security audit workflow" and "Update security audit workflow," and the file was named .github/workflows/security-audit.yml.
Malicious GitHub Action exfiltrated credentials to 193.32.204[.]199
The file masqueraded as a security tool but did not run security checks. Instead, the workflow stole credentials from affected repositories and transmitted them over HTTP to the external server at 193.32.204[.]199, Socket reported. The researchers found the malicious workflow on default branches and confirmed that it had executed in affected repositories as of October 9, 2026.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTechnique mirrors GhostAction but broadens what is taken
Socket drew a parallel between the activity and GhostAction, a malicious campaign discovered by GitGuardian in September 2025 that reappeared in October 2026. Unlike earlier GhostAction attacks that primarily targeted secrets configured for GitHub Actions (API keys and access tokens used by automated workflows), the variant Socket documented also searches repository files and the complete Git history for credentials. Using regular-expression patterns, the workflow can locate sensitive data that developers accidentally committed to source code, configuration files or earlier versions of files — including credentials for cloud providers and AI services.
Notable repositories and infection characteristics
Socket's analysis lists specific infection vectors and affected projects. Examples include AI GitHub projects created by 'henrywoo' — henrywoo/pyllama and henrywoo/chatllama — and kitao/pixel, which the report says is typically distributed through both the Python Package Index (PyPI) and crates.io. The workflow was also found in an Uber-owned project, uber/athenadriver, where Socket notes 'henrywoo' has write access as its original author. The report further names kitao/pyxel among repositories where the malicious workflow remained on default branches as of October 9, 2026.
Socket observed that even repositories inactive for a decade were affected, and that the activity appears to have been automated rather than manually targeted — suggesting the attackers systematically enumerated every repository to which the compromised accounts had write access, rather than selecting targets by activity or perceived value.
Observed outcomes and limits reported by Socket
- Socket confirmed the workflow had executed in affected repositories, so credential exfiltration was not merely an attempted injection.
- As of the time of Socket’s report, researchers had not observed any malicious package versions published to PyPI or crates.io as a result of the campaign. Socket cautioned that this absence of observed malicious package releases does not mean the stolen credentials have not been used for other purposes — only that the researchers had not identified evidence of follow-on malicious package releases on those two registries.
How technologists, enterprises, and open-source maintainers are implicated
- Technologists and security teams: will need to treat repository workflows and Git history as possible exfiltration surfaces, because the malicious workflow both accessed GitHub Actions secrets and scanned files and the full Git history for credentials.
- Enterprises and organizations that own repositories: face exposure where users with write permission — including original authors — can introduce automated tasks that run on default branches; Socket’s report highlights that organization-owned projects such as uber/athenadriver were affected.
- Open-source maintainers: should note that even long-dormant repositories were compromised, since the campaign appears to have enumerated all repositories with write access rather than focusing on active projects.
The Socket report places this campaign within an existing pattern — a GhostAction-like kill chain that has adapted to steal more kinds of credentials — and confirms the aggressor succeeded in deploying and executing the malicious workflow across tens of thousands of repositories. Socket’s contemporaneous finding that it had not observed follow-on malicious package uploads to PyPI or crates.io leaves a pointed and practical question: if repository credentials and historical secrets have been exfiltrated, how — and where — will those credentials be used next?
