🧰 uber/athenadriver

The items that name it 3

• GhostAction Attack Escalates By Targeting GitHub Users
  writeupas affected products2026-10-09It is written here as uber/athenadriver (injected directly to master, unsigned commit, via the original author's retained write access).

  injected directly to master, unsigned commit, via the original author's retained write access

• GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
  writeupas classification.key entities2026-10-09
• New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
  writeupas affected products2026-10-09

  Uber-owned GitHub repository; malicious workflow committed via compromised henrywoo account, which has write access as original author.