Hackers target 61 GitHub repos with command injection
Original title: Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets
Coordinated attack on 61 repositories used command injection in GitHub Actions to steal CI/CD secrets; 83 malicious issues and PRs identified.
Hackers targeted 61 public GitHub repositories in a campaign exploiting command injection in GitHub Actions workflows. Attackers posted malicious issues, pull requests, and comments containing Bash command substitution expressions that executed in workflows. Injected commands collected environment variables, encoded them with Base64, and sent them to an external server. The campaign began with 77 malicious items in about 43 minutes on September 1, 2026, followed by six more in a second wave.
Unconfirmed: no confirmation that stolen secrets were actually exfiltrated
- 83 malicious issues, pull requests and comments posted
- Targets included Google LangExtract, Trivy, Brave Browser, MLflow, ToolJet, PX4-Autopilot
- Payload ran env to collect environment variables
- Commands sent via curl to 54.205.16[.]142 port 8443
- No confirmed stolen secrets or repository compromises
Impact: command injection allowing execution of attacker-controlled commands in CI/CD workflows
- 1.pass untrusted titles through environment variables
- 2.avoid eval and shell injection
- 3.limit workflow permissions
- Products
- GitHub Actions
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 54.205.16.142 | 28488 (source : Radware ) Every verified payload pointed to 54.205.16[.]142 on port 8443, with a separate collection identifier for e |
From the original article
3 min read at cybersecuritynews.com
Hackers targeted 61 public GitHub repositories in a coordinated command injection campaign designed to steal data from automated development systems. Radware researchers identified 83 malicious issues, pull requests, and comments posted on September 1, 2026, with evidence that injected commands executed inside two GitHub Actions workflows. The findings show how routine project discussions can become […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.