What happened
GhostAction — a supply-chain campaign using stolen GitHub credentials — evolved a second stage on Oct 14-15, 2026 (a week after GitHub blocked its Stage-1 workflow injection). Stage 1 had already hijacked roughly 1,900 GitHub accounts and 30,000+ repositories to run credential-stealing Actions workflows that pulled secrets (npm, PyPI, DockerHub, AI-provider keys) from CI. Stage 2 planted a fake Font Awesome 'font' file (actually 38 lines of Node.js) into 94 repositories across 66 owners, wired to run automatically through a task labeled 'eslint-check' in .vscode/tasks.json when a developer opens the project in VS Code. It collects username/hostname/env vars, recursively searches the home directory for AWS keys, GitHub/npm/PyPI tokens and Anthropic API keys, installs a cron job, and carries an embedded instruction aimed at the Cursor coding agent — a prompt-injection-style directive telling the agent to run the file.
Why it matters
This is a direct attack on the AI developer toolchain: the payload is triggered by simply cloning and opening a repo in an AI-enabled IDE, and it specifically targets the credential stores AI coding agents and agent pipelines rely on (CLI/cloud/SSH plus AI-provider API keys). Cloning a legit-looking repo now runs attacker code on a developer's workstation and in their CI, exposing model-provider and cloud credentials that agents hold. The Cursor directive means an agent can be tricked into acting on the attacker's planted instruction.
Attack vector
Clone-and-open of a poisoned repo in VS Code/Cursor triggers a .vscode/tasks.json autostart task; a hidden prompt instruction to the Cursor agent reinforces execution; Stage-1 hijacked Actions workflows steal CI secrets.
Affected systems
VS Code / Cursor coding agents and repos carrying a fake .vscode/tasks.json 'eslint-check' task; GitHub Actions workflows referencing Stage-1 injected actions
Mitigation
Review .vscode/tasks.json and .github/workflows in repos cloned since Oct 8; revoke GitHub tokens from a clean device first (not from the infected machine), then rotate AWS keys, npm/PyPI tokens and AI-provider keys; require workflow approval and pin Actions to commit SHAs.