Loading story…
Researchers disclosed a large-scale automated supply chain attack dubbed Megalodon that pushed 5,718 malicious commits into 5,561 GitHub repositories in less than six hours, using forged CI/CD bot identities and benign-looking commit messages to slip in malicious GitHub Actions workflow files. The workflows requested elevated permissions and carried base64-encoded bash payloads that executed after maintainers merged the changes, harvesting CI/CD environment data, cloud credentials, SSH keys, Docker and Kubernetes secrets, Vault and Terraform credentials, GitHub OIDC tokens, and other source-code and developer secrets. Investigators said the stolen data was exfiltrated over HTTP POST requests to 216.126.225[.]129:8443, with two workflow variants observed, including payloads labeled SysDiag and Optimize-Build.
The most visible downstream impact was a compromise of the Tiledesk repository, where a malicious workflow change led to the publication of poisoned @tiledesk/tiledesk-server npm versions 2.18.6 through 2.18.12. Reporting tied the activity to a broader pattern of software supply chain abuse associated with TeamPCP, whose earlier incidents affected major open-source and commercial projects and prompted npm to invalidate some write-capable granular access tokens that could bypass 2FA protections. Security firms urged organizations to review repositories for unauthorized workflow changes, block the identified command-and-control infrastructure, rotate exposed secrets and keys, and inspect cloud and CI logs for signs of credential theft or cloud impersonation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
More than a week after the May 18 Megalodon campaign, OX Security said it had initially identified about 3,500 affected GitHub repositories and later estimated roughly 2,900 still remained infected. The assessment indicated the malicious workflow implants persisted well beyond the initial six-hour mass compromise window.
StepSecurity reported that Black-Iron-Project and WISE-Community were among the confirmed repositories compromised in the Megalodon campaign, expanding the list of specifically named victims beyond Tiledesk. The report placed these victim disclosures in the context of the May 18 mass GitHub Actions workflow compromise affecting 5,561 repositories.
SafeDep separately identified a throwaway npm publisher, polymarketdev, that uploaded nine malicious Polymarket-themed packages intended to trick users into submitting Ethereum or Polygon private keys to a Cloudflare Worker endpoint. The packages were reported in coverage of the broader Megalodon and related supply chain activity.
By 2026-05-21, SafeDep had publicly reported the Megalodon campaign, stating that thousands of repositories were affected and detailing the malicious workflow techniques and credential theft behavior. Reporting also connected the activity to a broader software supply chain abuse wave associated with TeamPCP.
As a downstream impact of the GitHub compromises, a malicious workflow change in the Tiledesk repository resulted in the maintainer publishing compromised @tiledesk/tiledesk-server npm versions 2.18.6 through 2.18.12. SafeDep identified the embedded payload in the Tiledesk package and linked it to the broader Megalodon campaign.
The implanted GitHub Actions workflows deployed base64-encoded bash payloads that harvested CI environment data, cloud credentials, SSH keys, Docker and Kubernetes secrets, Vault and Terraform credentials, GitHub OIDC tokens, and other source-code-related secrets. Researchers said the stolen data was exfiltrated to 216.126.225.129:8443, including via HTTP POST requests using the parameter string "megalodon."
On 2026-05-18, an automated supply chain attack dubbed Megalodon pushed 5,718 malicious commits into 5,561 GitHub repositories within roughly six hours. The commits used fake CI/CD bot-style identities and inserted malicious GitHub Actions workflow files designed to run after merges or remain dormant for later activation.
A separate supply chain incident reportedly involved a Claude-powered AI bot compromising five major GitHub repositories. This predates the May 2026 Megalodon campaign and represents a distinct repository compromise event.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
18 references tracked. Mallory keeps watching after this page renders.
protoslabs.io
Open sourcecommunity.gurucul.com
Open sourcecysecurity.news
Open sourcesafedep.io
Open sourcetheregister.com
Open sourcethreats.wiz.io
Open sourceox.security
Open sourcecybernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large software supply-chain campaign dubbed **Mini Shai-Hulud** compromised more than 170 npm packages and at least two PyPI packages tied to projects including **TanStack, Mistral AI, OpenSearch, UiPath, Guardrails AI,** and others. Researchers and vendors attributed the activity to **TeamPCP**, saying the attackers abused GitHub Actions release workflows—especially `pull_request_target`, cache poisoning, and theft of short-lived **OIDC** material from runners—to publish trojanized packages with apparently legitimate **SLSA** provenance, Sigstore attestations, and trusted-publishing signatures. Reports variously counted between roughly 160 and 400+ malicious package versions, with some affected packages totaling hundreds of millions of downloads, and OpenSearch and Mistral both confirmed compromised releases while TanStack described a chained workflow attack on its publishing pipeline. The malware targeted developer workstations and CI/CD systems, stealing **npm**, **GitHub**, cloud, Kubernetes, Vault, SSH, Docker, and AI-tool credentials, then attempting worm-like propagation by republishing infected packages with stolen tokens or workflow-issued publish credentials. Investigators said the payload also established persistence through **VS Code** tasks, **Claude Code** hooks, and in some cases system services, while exfiltrating data through **Session**, GitHub dead drops, and other attacker infrastructure; some variants included extortion notes, dead-man-switch logic, and geofenced destructive behavior. Defenders were urged to treat hosts that installed affected versions as potentially fully compromised, remove persistence before revoking tokens where applicable, rotate all exposed secrets from clean systems, invalidate CI caches, audit lockfiles and publishing activity, and rebuild impacted environments from trusted sources.
Jul 12, 2026
Researchers reported that the `prt-scan` campaign abused misconfigured GitHub Actions workflows using the `pull_request_target` trigger to run attacker-controlled code from forked pull requests in privileged CI contexts. The actor used at least six GitHub accounts to submit more than 500 malicious pull requests across six waves, disguising many as routine CI updates and tailoring payloads to Python, Node.js, Go, Rust, and GitHub Actions repositories. Wiz said the operation evolved from simple bash payloads into AI-assisted, repository-aware implants designed to steal `GITHUB_TOKEN` values, enumerate secrets, probe cloud metadata services, and exfiltrate credentials through workflow logs and pull request comments. The campaign succeeded often enough to cause real supply-chain impact despite an estimated success rate below 10%. Wiz confirmed compromise of the npm packages **`@codfish/eslint-config`** and **`@codfish/actions`** across 106 versions, and verified theft of AWS keys, Cloudflare API tokens, and Netlify authentication tokens. High-profile projects including Sentry, OpenSearch, IPFS, NixOS, Jina AI, and recharts reportedly blocked the attempts through contributor approval gates and workflow restrictions. The activity follows earlier warnings from Sysdig that insecure use of `pull_request_target` in prominent repositories such as MITRE, Splunk, and Spotipy could expose secrets and high-privilege `GITHUB_TOKEN` permissions, underscoring that unsafe GitHub Actions defaults remain an active software supply-chain risk.
Jun 29, 2026
Threat actors compromised the popular GitHub Actions repositories `actions-cool/issues-helper` and `actions-cool/maintain-one-comment` by moving version tags to imposter commits outside the normal commit history, causing workflows that referenced those tags to fetch and run malicious code. Researchers said the payload downloaded the **Bun** JavaScript runtime, read memory from the GitHub Actions `Runner.Worker` process to recover decrypted secrets, and exfiltrated the data over HTTPS to the attacker-controlled domain `t.m-kosche[.]com`; workflows pinned to a known-good full commit SHA were not affected. GitHub later disabled access to the repository for a terms-of-service violation, while StepSecurity added the action to its Compromised Actions Policy and blocked the exfiltration domain through Harden-Runner. The incident highlights a broader GitHub Actions supply-chain risk in which CI/CD trust can be subverted through mutable references and weak integrity controls. Separate research showed that a modified Maven wrapper in a pull request could achieve code execution on GitHub-hosted runners and, if merged, later expose release secrets such as Maven publishing credentials and GPG material, underscoring the need for checksum validation on wrapper scripts and immutable pinning to trusted commit SHAs for third-party actions. StepSecurity also linked the same exfiltration infrastructure to the recent **Mini Shai-Hulud** activity targeting npm packages in the `@antv` ecosystem, suggesting the GitHub Actions compromise may be part of a wider supply-chain campaign.
Jun 29, 2026