athenadriver repository distributed a credential-stealing workflow

A retained maintainer account gave an attacker a direct route into Uber's athenadriver repository on October 8. The project provided a Go database driver for Amazon Athena, letting applications query the service through familiar database interfaces. StepSecurity traced a malicious security-audit.yml commit to the compromised account of original author Henry Wu, near the end of a rapid sweep across repositories that account could modify.

The captured workflow contained no populated list of named Actions secrets. Instead, it requested the complete repository history and searched the checkout and earlier changes for credential-like strings. This made a repository without an obvious publishing secret useful to the attacker. Old code and examples could still contain keys. The script also gathered context around AWS identifiers, rather than assuming an access-key ID by itself supplied a complete credential.

The resulting text was sent by an HTTP POST to 193.32.204.199. StepSecurity examined the actual run log and found the collector's acknowledgment, confirming delivery of a request. That acknowledgment did not disclose which live credentials, if any, were in its body. The researchers also noted faulty regular-expression syntax in some searches, so the workflow's broad intentions should not be mistaken for exhaustive or flawless collection.

OpenSourceMalware's wider GhostAction investigation described the same shift from named CI secrets toward repository-history mining. In athenadriver, the confirmed intrusion was malicious upstream automation and an executed outbound request. It did not establish that the Go driver delivered a backdoor to applications using Athena or that Uber's infrastructure was subsequently accessed. The available record left the validity and later use of any harvested credentials unresolved.