A supply chain attack involving malicious GitHub Action workflows has impacted hundreds of repositories and thousands of secrets, developer security firm GitGuardian revealed on Friday.
The company noticed on September 2 that the GitHub account of the maintainer of a project named FastUUID, which GitGuardian uses internally, had been compromised and a malicious workflow file had been injected into the project.
GitHub Action workflows enable developers to automate development tasks that they would normally conduct manually. The workflow added to the FastUUID project was designed to harvest secrets and send them to a server controlled by the attacker.
In the case of the FastUUID project, the attacker obtained a PyPI token used for package deployment. While the token could have allowed the hacker to compromise the FastUUID package on PyPI, there is no indication of this occurring before the malicious commit was discovered and reverted.
However, further analysis conducted by GitGuardian researchers showed that the attack on FastUUID was part of a large-scale campaign that the security firm has dubbed GhostAction.
Indicators of compromise (IoCs) revealed that the campaign had targeted 327 GitHub users and 817 repositories.
The attacker enumerated secrets from legitimate workflow files, then hardcoded the secret names into malicious workflows. Over 3,300 secrets were leaked, including DockerHub credentials, GitHub tokens, and NPM tokens, as well as secrets associated with Sonar, Confluence and AWS instances.
“Initial discussions with affected developers confirmed that attackers were actively exploiting the stolen secrets, including AWS access keys and database credentials,” GitGuardian said.
“Several companies were found to have their entire SDK portfolio compromised, with malicious workflows affecting their Python, Rust, JavaScript, and Go repositories simultaneously,” it added.
Many of the impacted repositories reverted the malicious changes and a majority of the rest have been notified by GitGuardian. The GitHub, PyPI and NPM security teams have also been alerted.
“We are maintaining ongoing surveillance of those and other package registries to verify that no compromised tokens were used to publish malicious artifacts,” the security firm said. “From our initial investigations, so far, 9 NPM and 15 PyPI packages are at risk of compromise in the next hours or days.”
GitGuardian pointed out that the GhostAction campaign does not appear to be linked to the recent S1ngularity attack.
Related: Salesloft GitHub Account Compromised Months Before Salesforce Attack
Related: Over 6,700 Private Repositories Made Public in Nx Supply Chain Attack
