# ghostaction-returns-a-security-audit-yml-workflow-pushed-from: GhostAction Returns: A security-audit.yml Workflow Pushed From Compromised Maintainer Accounts Sends Actions Secrets, and Keys From Full Git History, Including Anthropic, OpenAI and OpenRouter Keys

> GhostAction Returns: A security-audit.yml Workflow Pushed From Compromised Maintainer Accounts Sends Actions Secrets, and Keys From Full Git History, Including Anthropic, OpenAI and OpenRouter Keys is a high-severity supply chain compromise issue in GitHub repositories into which a compromised maintainer account pushed security-audit.yml from, a CI integration. Affected: GitHub repositories into which a compromised maintainer account pushed security-audit.yml from 8 October 2026, and every secret in their Actions settings or anywhere in their git history..

- **Canonical URL:** https://catalog.anomity.ai/vuln/ghostaction-returns-a-security-audit-yml-workflow-pushed-from
- **Aliases:** ti-162
- **Severity:** high
- **Attack type:** Supply chain compromise, Credential theft
- **Component:** GitHub repositories into which a compromised maintainer account pushed security-audit.yml from (CI integration)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-08
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/ghostaction-returns-a-security-audit-yml-workflow-pushed-from

## Summary

On 8 October 2026 an attacker used two compromised open-source maintainer accounts to push a workflow named security-audit.yml into 345 repositories, 279 of them forks, according to a Cloud Security Alliance research note dated 12 October that rests mainly on StepSecurity's analysis (StepSecurity counted 378 repositories by code search on 9 October, and other reported counts vary widely). The workflow sends the repository's GitHub Actions secrets, plus credentials it finds anywhere in the full git history, including Anthropic, OpenAI and OpenRouter API key patterns, to a hard-coded IP address over plain HTTP. It repeats the GhostAction pattern first documented in September 2025, and because it reads history, keys deleted from a repository long ago but never revoked are exposed too.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| GitHub repositories into which a compromised maintainer account pushed security-audit.yml from 8 October 2026, and every secret in their Actions settings or anywhere in their git history. | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run GitHub repositories into which a compromised maintainer account pushed security-audit.yml from 8 October 2026, and every secret in their Actions settings or anywhere in their git history..

## How do I fix it?

Search your organization for workflow files you did not add, security-audit.yml in particular, and for pushes from unexpected maintainer accounts since 7 October. For every affected repository, rotate all Actions secrets and every credential ever committed to its history, including old Anthropic, OpenAI and OpenRouter keys, not just the secrets currently configured. Protect .github/workflows with CODEOWNERS and required reviews, default GITHUB_TOKEN to read-only, and keep AI provider keys out of repository secrets where an OIDC-based or per-environment secret can be used instead.

## References

- article: https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/10/CSA_research_note_github_actions_workflow_credential_theft_20261012-csa-styled.pdf

## Related vulnerabilities

- [beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot](https://catalog.anomity.ai/vuln/beyondtrust-a-hidden-comment-on-a-github-issue-hijacked-the-copilot) — high
- [litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook](https://catalog.anomity.ai/vuln/litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook) — critical
- [tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm](https://catalog.anomity.ai/vuln/tensorlake-npm-sdk-0-5-144-compromised-by-a-shai-hulud-chaindrop-worm) — critical
- [memtensor-compromise-poisoned-openclaw-memory-plugin-and-memoryos](https://catalog.anomity.ai/vuln/memtensor-compromise-poisoned-openclaw-memory-plugin-and-memoryos) — critical
- [mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across](https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across) — critical
- [anthropic-september-2026-threat-report-fake-claude-code-installers-and](https://catalog.anomity.ai/vuln/anthropic-september-2026-threat-report-fake-claude-code-installers-and) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=ghostaction-returns-a-security-audit-yml-workflow-pushed-from