[Single source] Malicious Workflow Steals Credentials from Tens of Thousands of GitHub Repositories
On 8 October 2026, two GitHub accounts, 'henrywoo' and 'kitao', pushed a malicious GitHub Actions workflow disguised as a security audit that steals credentials and sends them to an external server; Socket researchers found it in tens of thousands of repositories, including Uber's uber/athenadriver. As of 9 October 2026, Socket reported the workflow was still present on default branches and had successfully executed. Organizations should remove '.github/workflows/security-audit.yml' and revoke all exposed secrets, including deleted ones, as the full Git history is also searched.
In 30 seconds
Security researchers have detected a malicious workflow compromising tens of thousands of GitHub repositories, including Uber-owned ones, in what is being reported as a new supply chain attack.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
What happened
According to Infosecurity Magazine, security researchers detected a malicious workflow affecting tens of thousands of GitHub repositories, including repositories owned by Uber.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
Why it matters
The incident is characterized by the report as a supply chain attack, meaning the compromise originates in the development and distribution layer rather than in a single target.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
Given the reported scale and the involvement of repositories belonging to a major company like Uber, the potential concern is that dependents, CI/CD pipelines, or downstream consumers of the affected repositories could be exposed; the available evidence does not document any actual downstream impact.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
What to do
The available evidence includes no specific remediation guidance. As a general precaution inferred from the nature of the incident, maintainers should audit their GitHub Actions workflows for unfamiliar or recently modified entries, rotate credentials and tokens associated with affected repositories, and await advisories from GitHub or the detecting researchers before assuming safety.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
Confirmed and still uncertain
Established so far: security researchers detected a malicious workflow affecting tens of thousands of GitHub repositories, including Uber-owned ones, in a report published by Infosecurity Magazine dated November 8, 2026.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
Not established in the available evidence: who is behind the campaign, the exact number of affected repositories, what the malicious workflow does, how it was distributed or spread, whether Uber or GitHub have responded, and whether the activity is ongoing.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
What people are saying
Infosecurity Magazine relays the claim that 'security researchers have detected' the malicious workflow; the excerpt does not name the researchers, vendors, or organizations behind the detection.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
No statements from GitHub, Uber, or any affected maintainers appear in the provided evidence.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
Evolution
The report presents this as a newly detected campaign; the evidence batch contains no timeline for when the malicious workflow first appeared, how it evolved, or whether it is still spreading.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
Reach
1 independent groups, 1 updates, and 0 engagements.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
Technical detail
The only technical detail in the evidence is that the compromise manifests as a 'malicious workflow' affecting repositories at scale.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
In the GitHub context, a workflow typically refers to a GitHub Actions workflow file, which can execute code with access to repository secrets; the excerpt does not specify file names, triggers, payloads, persistence mechanisms, or how the workflow propagates between repositories, so these details remain unverified.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
Sources and evidence
This story rests on a single item: an Infosecurity Magazine article titled 'New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositories', published November 8, 2026 and ingested via RSS as a primary source. The body of the article is a one-sentence summary, so specific claims above are thin single-source reporting pending independent corroboration from the detecting researchers, GitHub, or Uber.New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rssOpen original sourceSee in source list
Sources
- New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositoriesinfosecurity-magazine.com · rss
