GitHub Supply Chain Attack Targets 61 Repositories via Automated Workflows
Attackers exploited CI/CD vulnerabilities using hidden HTML comments to exfiltrate sensitive repository credentials.
1Coordinated Attack Campaign
Researchers identified 83 malicious items targeting 61 public GitHub repositories within a 45-minute window on September 1. The campaign utilized 74 distinct GitHub accounts, many appearing to be compromised legitimate profiles. This rapid, synchronized execution suggests a single actor aiming to gain unauthorized repository access and manipulate open source codebases.
2Stealthy Injection Mechanism
The attack leverages hidden HTML comments within issues, pull requests, or comments to bypass visual detection. Because these payloads remain invisible on rendered pages, they effectively mask malicious commands. When a repository is configured to trigger workflows based on these events, the hidden code executes automatically within the CI/CD environment.
3CI/CD Workflow Vulnerability
The malicious payload is incorporated directly into shell source code during the automated workflow execution. This process allows attackers to harvest environment variables and exfiltrate sensitive data to external servers. The vulnerability exists because workflows often treat external event content as trusted, enabling unauthorized command execution without requiring repository write permissions.
4High-Profile Target List
Targeted projects include widely used software such as Google LangExtract, Trivy, Brave browser, and MLflow. Many affected repositories boast significant popularity, with agno-agi/agno holding 42.7K stars and ToolJet/ToolJet reaching 41.1K stars. These projects serve as critical infrastructure for thousands of organizations, amplifying the potential impact of any successful credential theft.
5Scope of Compromise
While researchers confirmed two instances where malicious commands successfully executed within automation environments, the full extent of the breach remains under investigation. It is currently unclear if the attacker successfully obtained write permissions or modified source code. The primary objective appears to be the systematic collection of repository credentials and tokens.
6Ease of Execution
The attack vector is notably accessible, as any user with a GitHub account can theoretically initiate this process. By exploiting existing repository configurations that automatically trigger workflows, attackers minimize their direct interaction with the target. This low barrier to entry makes it an attractive method for large-scale, automated supply chain campaigns.
7Mitigation and Defense
Radware researchers recommend implementing the principle of least privilege for all CI/CD workflows. Developers should strictly limit the secrets and environment variables accessible to automated jobs. Furthermore, treating all external content as untrusted is essential to preventing the execution of hidden commands within sensitive build and deployment automation pipelines.
8Industry Security Implications
This campaign highlights the growing trend of attackers targeting open source security and development tools to compromise downstream software. As maintainers work to close identified vulnerabilities, the incident underscores the persistent risk of supply chain attacks. Resilient workflow design remains the only effective defense against these evolving, automated exploitation techniques.