By Hamza Faisal
A supply-chain attack campaign dubbed GhostAction has escalated into a direct threat to developer workstations, after researchers found credential-stealing malware hidden inside what looks like an ordinary font file across 94 compromised GitHub repositories.
The discovery, published on October 19 by The Hacker News based on research from OpenSourceMalware, identified the second-stage payload in 94 repositories belonging to 66 different owners. The investigation began after Jamf Threat Labs researcher Thijs Xhaflaire spotted suspicious repositories while hunting infections from North Korea's PolinRider campaign.
A font file that runs code
The infection chain starts when a developer opens one of the compromised repositories in Visual Studio Code. A malicious .vscode/tasks.json configuration file carries a "runOn: folderOpen" trigger — a VS Code setting that executes a task automatically the moment its containing folder is opened. The file runs a task labeled "eslint-check" while suppressing terminal visibility.
That task invokes Node.js against public/fonts/fa-solid-400.woff2 — a file that looks like a standard Font Awesome web font but actually contains executable JavaScript. The file name is the same one used in North Korea's PolinRider campaign earlier this year, which researchers say borrows from Pyongyang's playbook.
Once running, the stealer sweeps the machine for AWS access keys, PyPI and npm authentication tokens, Git credentials, Kubernetes cluster credentials, SSH private keys — both RSA and Ed25519 — and login files for AI providers including Anthropic Claude and Google Gemini. A recursive search hunts credential patterns throughout the home directory, and everything collected is sent to attacker infrastructure over plain HTTP on port 8080.
Persistence that survives a cleanup
The malware also installs a cron job that fetches fresh attacker-supplied code every five minutes and pipes it straight into Bash, using a hostname-specific URL path tagged with the marker "#ghc2". Because the scheduled entry lives outside the repository, simply deleting the malicious repo files does not remove the foothold.
The attackers added a backup plan as well: a second GitHub Actions workflow — disguised with innocuous names like lint.yml, ci-check.yml, audit.yml or code-review.yml — activates if the local stealer never runs, collecting credentials and uploading them to a secret GitHub gist if the primary server cannot be reached.
An escalating arms race
GhostAction started out harvesting secrets through malicious GitHub Actions workflows. After GitHub blocked those workflows, the attackers shifted to a technique that operates outside the CI runner entirely — turning the repository itself into the delivery mechanism. Researchers note the second-stage files appeared about six days after GitHub's intervention, and in two cases attackers reintroduced the new malware even after repository owners had removed the original malicious workflows.
For developers, the defense is simple but unglamorous: treat unfamiliar repositories as untrusted in VS Code, review .vscode configuration files before opening them, rotate any credentials that may have been exposed, and audit repositories for unexpected additions like stray font files or workflow YAMLs.
By Hamza Faisal
