Socket has traced a supply chain campaign that planted a credential-stealing GitHub Actions workflow in tens of thousands of repositories, Uber’s among them.
One commit that looked routine
Two accounts, henrywoo and kitao, had permission to modify hundreds of repositories and used it on October 8 to push .github/workflows/security-audit.yml, staged as an ordinary single-file commit labeled “Add security audit workflow”.
Nothing in it audits anything. Each repository the file reaches gets its credentials lifted and shipped off to 193.32.204[.]199 over unencrypted HTTP, which makes the theft trivially interceptable and easy to spot in egress logs.
Reach stretched well past the two operators. Beyond the pair’s own AI projects, pyllama and chatllama, and the cross-language package kitao/pixel on PyPI and crates.io, the list runs to uber/athenadriver, where henrywoo holds write access as original author. Projects idle for a decade were infected too.
A GhostAction variation with a bigger haul
GitGuardian first documented this kill chain as GhostAction in September 2025, saw it return in October 2026, and Socket now charts a fresh variation. The early rounds were narrower in ambition, mostly after API keys and tokens sitting in Actions configuration.
This build hunts further, grepping repository files and the entire Git history by regex so a credential committed once and later deleted comes back out anyway. Build pipelines inherit privileges they never expected to carry, so one harvested token can become a route downstream.
On October 9, 2026, it stayed live on default branches throughout the set Socket inspected, and logs showed it had executed. No rogue versions hit PyPI or crates.io, but that leaves plenty of other uses for a working secret.
Treat any repository those two accounts could write to as compromised, rotate every secret a workflow could read, and audit Actions configuration for entries nobody remembers adding.
