Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour

As cited

Copy frozen at 2026-10-29 12:45 UTC (site build).

threat intel

Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour

Researchers discovered a coordinated attack campaign in which an individual using 74 compromised GitHub accounts posted malicious commands hidden in HTML comments across pull requests and issues on 61 public repositories between September 1 and October 13. The attack exploited GitHub's workflow automation to execute commands in continuous integration and continuous deployment (CI/CD) environments and exfiltrate credentials and access tokens, targeting widely used open source projects including Trivy, MLflow, and Brave browser.

Why it matters: Developers and organizations using affected open source projects face credential theft and potential code tampering if repository maintainers have not yet closed vulnerabilities or applied least-privilege access controls to CI/CD workflows.

Source published

2026-10-29 12:00 UTC

First seen by Cybersecurity Tracker

2026-10-29 12:07 UTC