GitHub issues used in CI attacks on 61 public repositories
Original title: Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
Radware counted 83 payloads, mostly within 43 minutes on September 1, aimed at stealing CI secrets; code changes remain unconfirmed.
Radware researchers identified at least 83 malicious GitHub issues, pull requests, or comments across 61 public repositories, including LangExtract, Trivy, Brave browser, and MLflow. Hidden commands in HTML comments could trigger vulnerable workflows, insert attacker-controlled content into shell commands, and attempt to exfiltrate environment variables. Logs showed the command ran in two automation environments. Researchers could not confirm stolen write access, source changes, or downstream compromise, and said most notified repositories were closed or fixed.
Unconfirmed: Radware suspects one coordinated actor and a supply-chain goal but has not confirmed stolen credentials or modified code.
- Seventy-seven items appeared in 43 minutes, with six more within two minutes.
- The activity used 74 GitHub accounts, many with development histories.
- Popular targets included agno, ToolJet, Trivy, MLflow, Brave, and Cilium.
- Radware advises least privilege and fewer secrets in externally triggered workflows.
Impact: Attempted theft of CI environment variables and access tokens
| Product | Affected |
|---|---|
| GitHub Actions workflows | — |
- 1.Give CI/CD workflows least-privilege access.
- 2.Separate externally triggered workflows from jobs with elevated permissions.
- 3.Treat external content as untrusted and limit workflow secrets.
- Organizations
- Radware
From the original article
3 min read at theregister.com'The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully'
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.