Attackers hit 61 GitHub repos in 43 minutes to steal CI/CD secrets

In a 43-minute window on September 1, attackers published 77 malicious items targeting 61 public GitHub repositories, with six more arriving within the next two minutes. Radware threat hunters identified at least 83 attacks in total, hitting popular open source projects including Google LangExtract, Trivy, Brave browser, and MLflow. The campaign, which the researchers suspect is coordinated, aims to execute commands in CI/CD environments and steal credentials and access tokens.

The attack chain is novel and stealthy. Attackers publish an issue, pull request, or comment containing malicious commands hidden in HTML comments, which are invisible on the rendered page. If a repository's workflow is configured to respond to that event, the workflow automatically triggers within a second, and the hidden command executes. "The workflow automatically is triggered within a second, and if the workflow is indeed vulnerable, then the attack is executed successfully," said Gabi Nakibly, VP and researcher at Radware. The workflow incorporates attacker-controlled content into shell source code, and the shell executes the malicious command, hoovering up environment variables and attempting to exfiltrate them to an attacker-controlled server.

Radware researchers Gabi Nakibly and Zvika Babo suspect a single individual is behind the campaign. The attacker used 74 different GitHub accounts, many with legitimate development histories, suggesting they were compromised. "Considering that dozens of accounts posted the same type of payload, on the same day, within a narrow time window, and to the same infrastructure, it is reasonable to assess that the activity was coordinated," the team wrote. The researchers discovered the campaign while investigating prompt injection in GitHub.

While the researchers examined logs from actual runs and found two cases with evidence that the malicious command ran inside the automation environment, they cannot definitively say whether the attacker obtained repository write permissions, modified source code, or compromised downstream software. "The big picture is that the attackers are trying to find every possible way to get inside the repos to get credentials," Nakibly said. "Basically, every user with a GitHub account can try to run this attack - it's very easy to start this attack," Babo added.

The affected repositories span AI frameworks, security tools, development infrastructure, databases, and other widely used open source software. The Radware report lists agno-agi/agno (42.7K stars), ToolJet/ToolJet (41.1K), google/langextract (38.9K), aquasecurity/trivy (38.4K), CopilotKit/CopilotKit (38K), and podman-container-tools/podman (33K) among the most popular. Other notable targets included QwenLM/qwen-code (28.5K), mlflow/mlflow (28.4K), discordjs/discord.js (26.8K), cilium/cilium (25.6K), brave/brave-browser (23.9K), dotnet/maui (23.3K), Homebrew/homebrew-cask (22.2K), github/docs (21K), apache/doris (16K), and PX4/PX4-Autopilot (12.8K). "These projects are used by thousands of organizations," Babo said.

The researchers disclosed their findings to all project maintainers, and most repositories were closed or fixed, but they cannot confirm all were. This campaign follows several earlier supply chain attacks against open source security and dev tools, as attackers increasingly look for new methods to steal credentials and other secrets. "There is no way to stop the attackers from attempting," Nakibly said. "The only way is to make sure that the workflow code is resilient, and not vulnerable to such attacks."

For executives, this is a reminder that open source dependencies and CI/CD pipelines are attack surfaces that can be exploited by any GitHub user. The researchers recommend applying least-privilege access to CI/CD workflows, separating workflows triggered by external events from jobs with elevated permissions, and treating external content as untrusted. "Developers should treat external content as untrusted, and also limit the secrets and environment variables that are available to the workflow," Babo said. The speed and scale of this campaign - 83 attacks in under an hour - shows how automated and low-cost these attempts have become. Organizations that rely on popular open source projects need to verify their own workflow configurations and ensure that secrets are not exposed to untrusted inputs.

The broader implication is that the software supply chain is only as strong as the least-secure workflow. Attackers are shifting from exploiting code vulnerabilities to abusing automation features that developers trust by default. A single misconfigured workflow in a widely used project can become a launchpad for credential theft, and the downstream impact could ripple through thousands of organizations that depend on that project. For CISOs and engineering leaders, the lesson is clear: every external event that touches a pipeline must be treated as a potential attack vector, and secrets must be scoped to the minimum necessary for each job. The Radware research shows that the barrier to entry is nearly zero - any GitHub account can attempt this - so proactive hardening is not optional.