More than 5,500 GitHub repositories were infected with malware in a supply chain attack, dubbed Megalodon, on May 18 that relies on automated commits (Ionut Arghire/SecurityWeek)
The article reports a large-scale supply chain attack dubbed Megalodon that infected over 5,500 GitHub repositories on May 18. The attack uses fake automated commits to inject malicious GitHub Actions workflows designed to steal credentials, CI secrets, keys, and tokens. This attack highlights critical vulnerabilities in CI/CD pipelines and supply chain security, directly impacting platform engineers and developers who rely on GitHub Actions for automated workflows. Audit your GitHub Actions workflows for unexpected automated commits, enforce strict secrets management, and implement supply chain security practices to prevent similar attacks.
