More than 800 GitHub repos affected in secret-stealing campaign

A GitHub supply chain attack affecting more than 800 repositories has led to the theft of more than 3,300 secrets, GitGuardian reported Friday.

The campaign, dubbed “GhostAction,” leverages compromised developer accounts to push malicious GitHub Actions workflows that exfiltrate secrets such as PyPI, npm and DockerHub tokens.

GitGuardian first discovered the attack on Friday through a malicious commit titled “Add Github Actions Security workflow,” which was pushed to the GitHub repo for FastUUID.

This commit, which injected a workflow that steals the PyPI token from FastUUID’s CI/CD environment, was pushed from the account of project maintainer Grommash9, whose account had been compromised.

GitGuardian quickly reported the attack through a GitHub issue and to PyPI, causing the malicious commit to be reverted and FastUUID’s PyPI project to be moved to read-only before any malicious package releases could be published.

However, after further investigation, GitGuardian identified 817 GitHub repositories with similar malicious commits pushed by 327 compromised developer accounts.

All of the malicious GitHub Actions workflows served to exfiltrate secrets from CI/CD environments to the same external endpoint. However, the attackers tailored the workflow to the available secrets enumerated from legitimate workflow files found in the targeted repos, GitGuardian noted.

Ultimately, the researchers found that at least 3,325 secrets were stolen through the GhostAction campaign, with DockerHub usernames and tokens being the most common type of secret stolen, followed by GitHub tokens and npm tokens. Sonar logins, Confluence tokens and AWS keys were also among the affected secrets.

The attacker could leverage these stolen secrets to conduct wider supply chain attacks, for example, by publishing malicious npm or PyPI packages through trusted developers’ accounts or replacing trusted packages with compromised versions.

“This incident provides cyber professionals with an excellent example of how malicious threat actors can operate at scale by using compromised credentials for accounts that are part of the software supply chain,” Jim Routh, chief trust officer at Saviynt, told SC Media in an email. “It is an extended attack surface for cyber criminals given the fundamental changes to software assembly using essential cloud accounts.”

GitGuardian worked to alert all affected users and projects where possible and also notified the GitHub, NPM and PyPI security teams. Some victims reported their stolen secrets were already being actively used by the attackers.

As of Friday, GitGuardian noted nine npm packages and 15 PyPI packages that were likely at risk of compromise due to stolen secrets.  

“These types of incidents will (unfortunately) continue until enterprises figure out that identity security is essential when establishing and managing all accounts. That means that your IAM practices must be applied when setting up, configuring cloud and managing (SaaS) accounts and not leaving it for your software engineers to figure out,” said Routh.