Researchers find coordinated attacks on 61 GitHub repositories
The campaign used malicious issue and pull-request content to target automated software workflows and credentials.
Security researchers have identified 83 malicious items across 61 public GitHub repositories in what they describe as a coordinated supply-chain campaign. They found evidence that commands ran in two affected workflows, but could not establish that attackers changed published code.
Radware said the malicious content appeared in issues, pull requests and comments on 1 September. Seventy-seven items were published within about 43 minutes, followed by six more in a second wave later the same day.
The attack targeted workflows using GitHub Actions, an automation system commonly used to test and build software. In vulnerable configurations, untrusted text from a repository item could be inserted into a shell command and executed by the workflow.
The researchers said the payloads attempted to collect environment variables and send them to an attacker-controlled server. Those variables can include credentials or access tokens, although the presence of a payload does not prove that sensitive information was successfully taken.
Radware identified targets including projects such as Trivy, MLflow, Brave Browser, Google LangExtract and GitHub’s documentation repository. Radware said maintainers were contacted after the investigation, but the researchers could not confirm that every affected repository had been fixed.
The incident illustrates a wider security problem: open-source projects must protect not only their source code and dependencies but also the automated systems that process public contributions. The campaign was reported on 29 October, although the underlying activity occurred earlier.
Also show the region and a close-up
Fact-check Approved · Priya Shah — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The number of repositories, timing and attack mechanism are supported by Radware’s research and independent reporting. The text distinguishes observed execution from unproven credential theft or code tampering.
- confirmed Researchers identified 83 malicious items across 61 repositories. — Reported in Radware’s investigation. source
- confirmed Seventy-seven items appeared within about 43 minutes. — Reported in the campaign timeline. source
- confirmed Commands ran in two workflows. — Radware reports direct evidence of execution in two cases. source
Editor's note
The campaign date is earlier, but the discovery and public disclosure are new on 29 October. The article does not claim confirmed theft or code modification where researchers found only attempts or potential impact.Sources
- Inside a GitHub Supply Chain Attack Campaign — Radware
- Attackers turn GitHub issues into supply chain campaign — The Register
More on this in other media
- Sky News — „github cybersecurity”
- BBC News — „github cybersecurity”
- The Guardian — „github cybersecurity”