https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/
-
@cR0w "...but nobody reviews workflow files in npm packages."
Ex-fucking-scuse me? That's an insane thing to not review.
-
@nyanbinary @cR0w they may as well have put on an actual firework show
@Viss @nyanbinary @cR0w a low bar and yet someone will still fail to clear it.
-
R relay@relay.publicsquare.global shared this topicR relay@relay.mycrowd.ca shared this topic
-
@cR0w lemme see if I can just pull the projects, actually. unfortunately github api is meh
@cR0w the fact that you can't get more than 1k paginated results is so fucking stupid, istg
-
@cR0w the fact that you can't get more than 1k paginated results is so fucking stupid, istg
@nyanbinary The API is giving me weird shit too. Shit that doesn't match my search query.
-
@nyanbinary The API is giving me weird shit too. Shit that doesn't match my search query.
@cR0w do we have an IFIN thread for this? Just to know where I'll dump the results & code
-
@cR0w do we have an IFIN thread for this? Just to know where I'll dump the results & code
@nyanbinary Not sure. I'm still dicking around with the search.
-
@nyanbinary Not sure. I'm still dicking around with the search.
@cR0w lmao, just hit a 502
-
@cR0w lmao, just hit a 502
@nyanbinary With less than 85% uptime, you're bound to hit some errors.
-
@nyanbinary With less than 85% uptime, you're bound to hit some errors.
@nyanbinary I can start an IFIN thread if you haven't already.
-
@nyanbinary Not sure. I'm still dicking around with the search.
-
@cR0w "...but nobody reviews workflow files in npm packages."
Ex-fucking-scuse me? That's an insane thing to not review.
-
Some interesting info in a couple repos by @j0hnnyxm4s
Security: Repository tampered via my compromised credential — cleanup required (megalodon campaign) · Issue #44 · chicagolandmesh/chicagolandmesh.org
TL;DR: My account johnnyxmas was the target of a supply-chain credential-theft campaign. On 2026-05-18, the attacker used my compromised credential — which had push access to this repo as a collaborator — to push a malicious commit and r...
GitHub (github.com)
Security: Repository tampered via my compromised credential — cleanup required (megalodon campaign) · Issue #36 · Xyl2k/TSA-Travel-Sentry-master-keys
TL;DR: My account johnnyxmas was the target of a supply-chain credential-theft campaign. On 2026-05-18, the attacker used my compromised credential — which had push access to this repo as a collaborator — to push a malicious commit and r...
GitHub (github.com)
@cR0w yeah man that supply chain is a bitch. Npm update stole a PAT and went to town. Luckily it only matters if you’re dumb enough to store keys in your repo. Tried to be as descriptive as possible.
-
@huronbikes @Azuaron @cR0w That in itself seems insufficient. NPM takes dependencies in a way that makes it so a version update might not even be expected by the developer. (Yes, saving the package lock helps with this, but still.)
-
Megalodon: Mass GitHub Repo Backdooring via CI Workflows
Over 5,700 malicious commits were pushed to GitHub repositories on May 18, 2026, replacing GitHub Actions workflows with base64-encoded secret exfiltration payloads. The "megalodon" campaign targeted repos including Tiledesk (9 repos), Black-Iron-Project (8 repos), and hundreds of others. @tiledesk/tiledesk-server versions 2.18.6-2.18.12 on npm carry the backdoor. C2: 216.126.225.129:8443.
SafeDep - Real-time Open Source Software Supply Chain Security (safedep.io)
Anyone searching GitHub yet for these commits? It would be nice to see a full list of impacted projects.
5,700+ commits in six hours, 5,561 repositories, one payload: replace a GitHub Actions workflow with a dormant secret exfiltration backdoor. The workflow_dispatch trigger design means these backdoors sit silent until activated, creating no visible CI runs.
Tiledesk shows how repository compromise cascades to package registries. Seven npm versions carried the backdoor because the maintainer published from a poisoned repo. Application code: untouched. Only the workflow file changed. Code review would catch this, but nobody reviews workflow files in npm packages.
If your repository received a commit from
build-system@noreply.devorci-bot@automated.devon May 18, 2026: revert it, audit your workflow files, and rotate any secrets available to GitHub Actions runners. Check your Actions tab for unexpected workflow_dispatch runs. If you use OIDC federation for cloud deployments, review cloud audit logs for token requests from unknown workflow runs.If you depend on
@tiledesk/tiledesk-server: pin to version 2.18.5 or earlier until the repository is remediated. The malicious commit remains on the master branch as of this writing.@cR0w It’s old news and not going away. Nobody is treating npm as what it has always been: the biggest malware repo since GitHub.
https://go.halcyon.ai/rs/401-WCH-435/images/Halcyon%20Cloudzy%20C2P%20Report.pdf?version=0
-
R relay@relay.infosec.exchange shared this topic
