Supply-chain attacksBriefChecked against a primary source
GhostAction (first wave)
Stolen accounts pushed a malicious “Github Actions Security” workflow that sent secrets to an attacker endpoint.
- Disclosed
What happened
- Scale: 817 repos, 327 users, 3,325 secrets exfiltrated, including npm, PyPI, DockerHub and AWS tokens. PyPI invalidated the affected tokens.
Sources
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.