Attackers Hide Commands in GitHub Issues to Target 61 Open Source Projects in Under an Hour

Researchers at Radware have identified at least 83 attacks against 61 public GitHub repositories, including well-known projects such as Google LangExtract, Trivy, Brave browser and MLflow. They suspect a coordinated campaign aimed at running commands in automated build and deployment (CI/CD) environments and stealing credentials and access tokens. Most of the malicious items (77) were published within a 43-minute window on September 1, and the other six followed within two minutes.

The researchers believe a single individual is behind the activity, which used 74 different GitHub accounts. Many of those accounts had legitimate development histories, which suggests they were likely compromised. The attack begins when the attacker publishes an issue, pull request or comment with malicious commands hidden in HTML comments, so the content does not appear on the rendered page. If a repository is set up to run a workflow in response to that event, the workflow starts automatically, and the attacker can remain hands-off. Radware's Gabi Nakibly said the workflow triggers within a second, and if it is vulnerable, the attack succeeds.

Nakibly's guess is that the final aim was a supply chain attack: with stolen repository credentials, the attacker could change the code and push malicious changes to others. The researchers found the campaign while investigating prompt injection in GitHub, and describe the attack chain as novel and extremely stealthy.