# GitHub Supply Chain Attack Targets 61 Repositories via Automated Workflows Attackers exploited CI/CD vulnerabilities using hidden HTML comments to trigger malicious shell commands. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-10-29 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/7d81571e-2b40-43ac-b386-50afa3b07d2a ## Coordinated Attack Campaign Identified Radware researchers identified 83 malicious attacks targeting 61 public GitHub repositories within a 45-minute window on September 1. The campaign utilized 74 different GitHub accounts, many of which appeared to be compromised legitimate profiles. This rapid, coordinated effort suggests a single actor aiming to gain unauthorized repository access and credentials. ## Novel Workflow Injection Mechanism The attack exploits GitHub CI/CD workflows by embedding malicious commands within hidden HTML comments in issues or pull requests. Because the content is invisible on rendered pages, it bypasses standard visual checks. If a repository is configured to trigger workflows automatically upon these events, the hidden shell commands execute immediately. ## Execution and Data Exfiltration Once triggered, the malicious workflow incorporates attacker-controlled content directly into shell source code. The shell then executes commands designed to harvest environment variables and sensitive access tokens, exfiltrating them to an external server. Researchers confirmed two instances where these malicious commands successfully ran within the target automation environments during their investigation. ## High-Profile Repository Targets The campaign targeted widely used open-source projects including Google LangExtract, Trivy, Brave browser, and MLflow. Other notable repositories affected include ToolJet, CopilotKit, and Podman, which collectively serve thousands of organizations. The breadth of these targets highlights the significant risk posed to the broader software supply chain through automated CI/CD pipelines. ## Low Barrier to Entry Researchers Gabi Nakibly and Zvika Babo emphasize that this attack method is extremely accessible. Any user with a standard GitHub account can attempt this injection without needing prior access to the codebase or repository permissions. This low barrier makes it a persistent threat for any project utilizing automated workflow triggers. ## Response and Remediation Efforts Radware disclosed their findings to the maintainers of all 61 affected repositories following the discovery. While many projects have since closed the vulnerabilities or implemented fixes, researchers cannot confirm universal remediation across all impacted targets. The incident underscores the ongoing challenge of securing open-source infrastructure against automated, stealthy credential harvesting attempts. ## Defensive Strategies for Developers To mitigate these risks, developers must treat all external content as untrusted and harden CI/CD workflow configurations. Implementing the principle of least-privilege access is critical for limiting the potential impact of a compromise. Furthermore, separating workflows triggered by external events from jobs requiring elevated permissions can prevent unauthorized access to sensitive secrets. ## Broader Supply Chain Implications This incident represents a growing trend of attackers shifting focus toward CI/CD automation to steal secrets. As open-source projects become central to enterprise software, these automated attack vectors pose systemic risks. Protecting the integrity of the build process is now as vital as securing the source code itself for modern development teams. ## Sources covering this story - https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._