In a recent cybersecurity breach, a coordinated command injection campaign targeted 61 public repositories on GitHub. This attack aimed to extract confidential data from automated development systems, posing significant risks to software security.
Details of the Cyber Attack
Research conducted by Radware revealed 83 malicious entries, including issues, pull requests, and comments, on September 1, 2026. These entries demonstrated how easily routine discussions in project workflows could be manipulated. Within a mere 43 minutes, 77 malicious items were identified, followed by an additional six in a subsequent wave.
Prominent projects such as Google LangExtract, Trivy, Brave Browser, MLflow, ToolJet, and PX4-Autopilot were among the targets. It’s important to note that not every project suffered a breach, but their inclusion in the attack highlights the potential vulnerability.
Exploiting GitHub Workflows
The campaign leveraged GitHub Actions workflows that inadvertently allowed user-controlled text to be incorporated into shell scripts. GitHub Actions can automate responses to various activities, such as issue openings or pull requests, making them attractive targets for exploitation.
Attackers inserted Bash command substitution expressions in the form $( ), which were processed by Bash as commands when included in vulnerable workflows. This allowed the execution of commands to collect environment variables, encode them, and attempt data exfiltration via HTTP POST requests.
Response and Mitigation Strategies
Despite the sophistication of the attack, there was no confirmed evidence of stolen secrets or compromised repositories, although some accounts showed signs of hijacking. Radware’s findings emphasized the need for enhanced security practices within GitHub workflows.
To mitigate such risks, maintainers are advised to handle untrusted input via environment variables rather than direct shell script insertion. It’s also crucial to review permissions, audit logs, and separate notification jobs from sensitive workflows to limit potential damage.
Radware’s report aligns with previous incidents, such as the GhostAction credential theft, underscoring the ongoing threats to CI/CD environments. Proactive measures and integration of threat intelligence remain essential for safeguarding development pipelines.
Organizations should consider rotating exposed credentials and closely monitoring unexpected outbound traffic to prevent potential breaches. Implementing these strategies can help protect against future threats and ensure the integrity of software development processes.
