Researchers Find 83 Attacks on 61 GitHub Repos in Suspected Supply Chain Campaign

Radware researchers identified at least 83 attacks against 61 public GitHub repositories, including Google LangExtract, Trivy, Brave browser, and MLflow, in what they suspect is a coordinated campaign to execute commands in CI/CD environments and steal credentials and access tokens. Most of the malicious items, 77 of 83, were published during a 43-minute span on September 1, with the remaining six appearing within the next two minutes. The researchers say the final aim may be a supply-chain attack in which an attacker gains repository credentials and can change code.

How the attack chain works

The researchers discovered the campaign while investigating prompt injection in GitHub. An attacker publishes an issue, pull request, or comment containing malicious commands hidden in HTML comments, so the content is not visible in the rendered page. A GitHub event can automatically trigger a workflow if the repository is configured to respond to that event. The workflow incorporates attacker-controlled content directly into shell source code, and the shell executes the hidden command, which collects environment variables and attempts to send them to an attacker-controlled server. The researchers examined logs from actual runs and found two cases with evidence that the malicious command ran inside the automation environment, but they cannot definitively say whether the attacker obtained repository write permissions, modified source code, or compromised downstream software.

The attacker does not need to compromise the repository or have access to its codebase, according to the researchers. Basically, every user with a GitHub account can try to run this attack, and it is very easy to start. The researchers suspect a single individual is behind the campaign and used 74 different GitHub accounts, many of which had legitimate development histories and were likely compromised.

Affected repositories

As of October 13, the threat hunters identified 83 GitHub items with a verified payload across 61 different repositories. The repos span AI frameworks, security tools, development infrastructure, databases, and other widely used open source software projects. The Radware report lists agno-agi/agno (42.7K stars), ToolJet/ToolJet (41.1K), google/langextract (38.9K), aquasecurity/trivy (38.4K), CopilotKit/CopilotKit (38K), and podman-container-tools/podman (33K) among the most popular. Other notable targets included QwenLM/qwen-code (28.5K), mlflow/mlflow (28.4K), discordjs/discord.js (26.8K), cilium/cilium (25.6K), brave/brave-browser (23.9K), dotnet/maui (23.3K), Homebrew/homebrew-cask (22.2K), github/docs (21K), apache/doris (16K), and PX4/PX4-Autopilot (12.8K). The researchers said these projects are used by thousands of organizations.

The researchers disclosed their findings to all of the projects' maintainers, and most of the repositories were closed or fixed, but they cannot confirm that all of them were. The campaign follows several earlier supply chain attacks against open source security and development tools as attackers increasingly look for new methods to steal credentials and other secrets.

What defenders can do

Radware VP and researcher Gabi Nakibly said there is no way to stop attackers from attempting, and the only way is to make sure workflow code is resilient and not vulnerable to such attacks. The researchers recommend applying least-privilege access to CI/CD workflows and separating as much as possible workflows triggered by external events from jobs with elevated permissions. Researcher Zvika Babo said developers should treat external content as untrusted and limit the secrets and environment variables that are available to the workflow.

Sources: The Register