Inside a GitHub Supply Chain Attack Campaign
Security researchers uncovered a coordinated attack campaign targeting public GitHub repositories through issues, pull requests, and comments to execute shell commands in CI/CD environments. The campaign utilized untrusted GitHub content processed unsafely by workflows to extract environment variables and exfiltrate them to an attacker-controlled server. Investigators confirmed actual command execution in multiple repositories, while affected account owners reported unauthorized activity. Open article →
- Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
- ‼️ A suspected lone attacker hit 61 GitHub repos, from Google's LangExtract to Trivy and Brave, w...
- GitHub Supply Chain Attack: Command Injection and CI/CD Data Exfiltration
- Attackers turn GitHub issues into supply chain campaign against 61 public repos
- Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an h...