Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows

Why It Matters

The breach demonstrates a new scale of supply‑chain attacks that can siphon thousands of cloud and CI credentials, threatening both open‑source projects and enterprises that rely on compromised packages. It forces developers and platform providers to rethink token security and automated workflow safeguards.

Key Takeaways

• Megalodon injected malicious GitHub Actions workflows into 5,561 repos.
• Payloads exfiltrate AWS, GCP, Azure credentials and CI secrets.
• Attacker used throwaway accounts and forged identities to push commits.
• Two variants: SysDiag (push trigger) and Optimize‑Build (manual trigger).
• NPM responded by revoking bypass‑2FA tokens and promoting Trusted Publishing.

Pulse Analysis

The Megalodon operation marks a watershed moment in software supply‑chain security, showcasing how automated, large‑scale campaigns can weaponize the ubiquitous GitHub Actions platform. By embedding base64‑encoded bash scripts within workflow files, the attackers gain execution rights inside CI pipelines, a privileged environment that often holds unrestricted access to cloud APIs and secret stores. The campaign’s speed—over 5,700 malicious commits in six hours—highlights the efficiency of using throwaway GitHub accounts, forged author metadata, and compromised personal access tokens to bypass traditional code‑review safeguards.

Megalodon builds on a lineage of supply‑chain compromises attributed to the TeamPCP group, which has previously targeted high‑profile open‑source projects such as TanStack, Grafana Labs, and OpenAI. The dual‑variant approach—SysDiag for broad reach and Optimize‑Build for targeted, on‑demand execution—illustrates a strategic trade‑off between infection density and operational stealth. By harvesting a wide array of secrets, from cloud instance role credentials to Terraform tokens, the attackers can pivot into victim environments, potentially exfiltrating data, deploying ransomware, or establishing persistent footholds. The geopolitical dimension, hinted at by wiper payloads aimed at Iranian and Israeli machines, adds a layer of state‑aligned motivation to the financially driven extortion model.

In response, ecosystem leaders are tightening token policies and encouraging stronger authentication mechanisms. NPM’s decision to invalidate bypass‑2FA tokens and promote its Trusted Publishing framework aims to cut the immediate credential leakage path, while GitHub is expected to enhance detection of anomalous workflow commits. Organizations should audit repository permissions, enforce least‑privilege PAT scopes, and adopt secret‑scanning tools that flag base64‑encoded payloads. As attackers continue to weaponize CI/CD pipelines, a proactive, defense‑in‑depth posture will be essential to safeguard the integrity of the global software supply chain.