Attackers target 61 public GitHub repos in suspected supply-chain campaign

The attacks were identified by Radware researchers Gabi Nakibly and Zvika Babo, who told The Register they suspect a single individual is behind the campaign. The attacker used 74 different GitHub accounts, many of which had legitimate development histories, suggesting they were likely compromised. Most of the 83 malicious items were published during a 43-minute time span on September 1, with the remaining six occurring within the next two minutes.

The attack chain, which the researchers describe as novel and stealthy, begins with the attacker publishing an issue, pull request, or comment containing malicious commands hidden in HTML comments. This content is not visible on the rendered page. A GitHub event, such as a pull request or issue, can automatically trigger a workflow if the repository is configured to respond to that event, allowing the attacker to be largely hands-off.

“The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully,” Nakibly said. The workflow incorporates attacker-controlled content directly into shell source code, and the shell executes the hidden malicious command, which collects environment variables and attempts to exfiltrate them to an attacker-controlled server.

While the researchers found two cases with evidence that the malicious command ran inside the automation environment, they cannot definitively say whether the attacker obtained repository write permissions, modified source code, or compromised downstream software. “The big picture is that the attackers are trying to find every possible way to get inside the repos to get credentials,” Nakibly said.

Affected repositories span AI frameworks, security tools, development infrastructure, databases, and other widely used open source projects, including agno-agi/agno, ToolJet/ToolJet, google/langextract, aquasecurity/trivy, CopilotKit/CopilotKit, and podman-container-tools/podman. “These projects are used by thousands of organizations,” Babo said.

The researchers disclosed their findings to the projects’ maintainers, and most repositories were closed or fixed, but they cannot confirm all were. They recommend applying least-privilege access to CI/CD workflows and separating as much as possible workflows triggered by external events from jobs with elevated permissions. “Developers should treat external content as untrusted, and also limit the secrets and environment variables that are available to the workflow,” Babo said.