Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour
Researchers identified a suspected coordinated campaign that used hidden commands in GitHub issues, pull requests and comments to target automation workflows in public repositories. The activity could expose credentials and access tokens, potentially allowing attackers to alter software and spread malicious code through its supply chain.
By 13 October, Radware had verified 83 malicious items across 61 repositories. Seventy-seven were posted in a 43-minute period on 1 September, followed by six more within two minutes; the activity used 74 GitHub accounts, many with legitimate histories. Researchers found evidence that the commands ran in two automation environments, but could not confirm whether repository credentials were stolen or software was changed.
In short
- 83 malicious items targeted 61 public GitHub repositories.
- The posts appeared in a 45-minute window.
- Researchers confirmed execution in two automation environments.
Explained simply
GitHub is a platform where people and organisations store software code and work together on changes. Public repositories are open to anyone, and their maintainers may use automated workflows to check contributions or carry out routine tasks.
Those workflows can be set up to react to activity such as issues, proposed changes called pull requests, or comments. If a workflow handles such activity without adequate safeguards, a malicious instruction could make it reveal credentials or access tokens. These are secret details that can grant access to code or other systems.
The risk is known as a software supply chain attack: compromising the tools or code used to build software can affect later versions and the people who use them. The reported findings show that automation was targeted, but do not establish whether credentials were taken or any software was changed.