Massive GitHub Issue Abuse Fuels Supply‑Chain Campaign Across 61 Repositories in Under an Hour

security

‘The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully’

EXCLUSIVE Researchers have uncovered at least 83 attacks targeting 61 public GitHub repositories, including popular open‑source projects such as Google LangExtract, Trivy, Brave Browser and MLflow. The activity appears to be a coordinated supply‑chain campaign designed to execute commands in CI/CD pipelines and exfiltrate credentials and access tokens.

The attacks unfolded extremely quickly, Radware threat hunters said in an exclusive interview with The Register. Seventy‑seven of the malicious items were posted within a 43‑minute window on September 1, with the remaining six occurring in the following two minutes.

“Our assessment is that the ultimate goal is a supply‑chain compromise in which the attacker gains repository credentials and the ability to modify code, then propagates malicious changes to downstream users,” said Radware VP and researcher Gabi Nakibly in the same interview.

Nakibly and his colleague Zvika Babo suspect a single adversary is responsible. The operator leveraged 74 different GitHub accounts, many of which had established, legitimate development histories, suggesting they were likely compromised.

“The fact that dozens of accounts posted identical payloads on the same day, within a narrow time frame, and against the same infrastructure strongly indicates a coordinated effort,” the team noted in their research shared prior to publication with The Register.

A novel attack chain

The campaign was identified while investigating prompt injection in GitHub. The researchers described the attack chain as both novel and highly stealthy.

First, the attacker creates an issue, pull request, or comment that contains malicious commands hidden inside HTML comments. This concealment prevents the content from appearing in the rendered page. Moreover, GitHub events such as issues or pull requests can automatically trigger repository workflows; if a workflow is vulnerable, the attack executes with minimal attacker involvement.

“The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully,” Nakibly explained.

The compromised workflow incorporates the attacker‑controlled input directly into shell scripts, which then run the hidden command. The command gathers environment variables and attempts to exfiltrate them to a server controlled by the attacker.

Although the researchers reviewed execution logs and identified two instances where the malicious command ran inside the automation environment, they cannot confirm whether the attackers obtained write permissions, altered source code, or compromised downstream software. “Our broader concern is that adversaries are exploring every possible avenue to infiltrate repositories and harvest credentials,” Nakibly observed.

“Crucially, the attacker does not need to compromise the repository or possess access to its codebase,” Babo added. “Essentially, any GitHub user can attempt this attack—it is relatively easy to initiate.”

Which repos were affected?

As of 13 October, the threat hunters had documented 83 GitHub items carrying the verified payload across 61 distinct repositories. The targets span AI frameworks, security tools, development infrastructure, databases, and other widely adopted open‑source projects.

The most notable repositories include agno‑agi/agno (42.7K stars), ToolJet/ToolJet (41.1K), google/langextract (38.9K), aquasecurity/trivy (38.4K), CopilotKit/CopilotKit (38K), and podman‑container‑tools/podman (33K). Other high‑profile targets were QwenLM/qwen‑code (28.5K), mlflow/mlflow (28.4K), discordjs/discord.js (26.8K), cilium/cilium (25.6K), brave/brave‑browser (23.9K), dotnet/maui (23.3K), Homebrew/homebrew‑cask (22.2K), github/docs (21K), apache/doris (16K), and PX4/PX4‑Autopilot (12.8K).

“These projects are used by thousands of organizations,” Babo noted.

The researchers disclosed their findings to all project maintainers. Most repositories have been closed or patched, though the team cannot guarantee that every instance has been fully remediated.

This activity follows a series of earlier supply‑chain assaults on open‑source security and development tools, reflecting a broader trend of attackers seeking new vectors to harvest credentials and secrets.

“There is no foolproof way to prevent attackers from attempting such exploits,” Nakibly said. “The most effective mitigation is to ensure that CI/CD workflow code is resilient and not vulnerable to abuse.”

The researchers advise implementing least‑privilege access controls for CI/CD pipelines and isolating workflows that respond to external events from jobs that require elevated permissions.

“Developers should treat any external input as untrusted and restrict the secrets and environment variables exposed to workflows,” Babo concluded. ®

Source link