Attackers Exploit GitHub Issues for Rapid Supply Chain Campaign
A swift, coordinated campaign leveraged malicious commands hidden in GitHub issues and pull requests to target 61 public repositories, aiming to compromise CI/CD pipelines and steal credentials.
Researchers have uncovered a novel and rapid supply chain attack campaign that targeted 61 public GitHub repositories, including prominent open-source projects like Google LangExtract, Trivy, and the Brave browser. The campaign, which saw the majority of its malicious activity concentrated within a 43-minute window on September 1, aimed to trigger CI/CD workflows, exfiltrate credentials and access tokens, and potentially gain write access to codebases.
Radware threat hunters identified at least 83 malicious items across these repositories, with the rapid pace and coordinated nature suggesting a single actor using compromised GitHub accounts. Many of these accounts exhibited legitimate development histories, indicating they were likely taken over to facilitate the attack. The researchers noted that dozens of accounts posted identical payloads within a narrow timeframe, pointing to a highly organized operation.
The attack chain is particularly stealthy, beginning with the attacker embedding malicious commands within HTML comments in GitHub issues, pull requests, or comments. This technique ensures the malicious content remains hidden from plain view in rendered pages. Crucially, these GitHub events can automatically trigger a repository's CI/CD workflow if configured to do so, allowing the attacker to initiate the compromise with minimal ongoing interaction.
Once triggered, a vulnerable workflow would automatically execute the hidden command. This command was designed to hoover up environment variables, which often contain sensitive secrets and access tokens, and exfiltrate them to an attacker-controlled server. While Radware observed evidence of malicious commands running in automation environments, they could not definitively confirm if the attackers successfully obtained repository write permissions or modified source code.
However, the primary objective appears to be the acquisition of credentials. The attackers do not need to compromise the repository itself or have direct access to its codebase to initiate this attack. This ease of execution means that virtually any user with a GitHub account could potentially attempt such an exploit, lowering the barrier to entry for supply chain attacks.
The targeted repositories span a wide range of critical open-source software, including AI frameworks, security tools, development infrastructure, and databases. Popular projects like agno-agi/agno, ToolJet/ToolJet, and aquasecurity/trivy were among the affected. The researchers disclosed their findings to the maintainers of these projects, and most have since been secured, though confirmation of all fixes is pending.
This campaign underscores a growing trend of attackers seeking new vectors to compromise software supply chains, particularly within the open-source ecosystem. While the immediate threat to these specific repositories may have been mitigated, the underlying technique highlights a significant vulnerability in how CI/CD workflows are configured and how external content is handled.
To defend against such attacks, developers are advised to treat all external content as untrusted, apply least-privilege access to CI/CD workflows, and limit the secrets and environment variables available to these automated processes. Separating workflows triggered by external events from those with elevated permissions is also a critical mitigation strategy.