Ethical Hacking News
A recent incident has exposed a novel supply chain attack that leverages GitHub issues to launch a coordinated campaign against 61 public repositories. The attack, which was identified by Radware threat hunters, involved the use of a novel attack chain that enabled the attackers to execute malicious commands within seconds of publishing a malicious issue on GitHub. The attack highlights the growing threat of supply chain attacks and the need for developers and organizations to be vigilant in protecting themselves against such attacks.
Attackers launched a coordinated campaign against 61 public GitHub repositories.Attackers used a novel attack chain to execute malicious commands within seconds of publishing a malicious issue.Attackers used hidden commands in HTML comments to avoid detection by security tools.A single individual is suspected to be behind the supply chain campaign, using 74 different GitHub accounts.Attackers targeted widely used open-source software projects, including AI frameworks and security tools.Attackers used GitHub's CI/CD environment to execute commands and steal credentials and access tokens.Researchers recommend applying least-privilege access to CI/CD workflows and treating external content as untrusted.
A recent incident has shed light on the evolving threat landscape of supply chain attacks, with attackers leveraging GitHub issues to launch a coordinated campaign against 61 public repositories. The attack, which was identified by Radware threat hunters, involved the use of a novel attack chain that enabled the attackers to execute malicious commands within seconds of publishing a malicious issue on GitHub.
The attack chain began with the publication of a malicious issue, pull request, or comment containing hidden commands in HTML comments. This ensured that the content was not visible in the rendered page, thereby avoiding detection by security tools. The GitHub event triggered a workflow, which automatically executed the hidden command, hoovering up environment variables and attempting to exfiltrate them to an attacker-controlled server.
The researchers, led by Radware VP and researcher Gabi Nakibly, suspect that a single individual is behind the supply chain campaign, using 74 different GitHub accounts, many of which had legitimate development histories. The attackers exploited the fact that dozens of accounts posted the same type of payload, on the same day, within a narrow time window, and to the same infrastructure, indicating a high level of coordination.
The attack was particularly stealthy due to the use of a novel attack chain, which enabled the attackers to bypass traditional security measures. The researchers noted that the workflow automatically triggered within a second, and if the workflow was indeed vulnerable, then the attack was executed successfully. This highlighted the importance of ensuring that workflow code is resilient and not vulnerable to such attacks.
The campaign targeted widely used open-source software projects, including popular projects such as Google LangExtract, Trivy, Brave browser, and MLflow. The affected repositories included AI frameworks, security tools, development infrastructure, databases, and other widely used open-source projects.
The Radware report revealed that the attackers used GitHub's CI/CD environment to execute commands and steal credentials and access tokens. The researchers noted that the attacker did not need to compromise the repository or access its codebase to execute the attack, making it a highly stealthy and effective campaign.
The researchers recommended applying least-privilege access to CI/CD workflows and separating workflows triggered by external events from jobs with elevated permissions. They also emphasized the importance of treating external content as untrusted and limiting the secrets and environment variables available to the workflow.
The incident highlights the growing threat of supply chain attacks and the need for developers and organizations to be vigilant in protecting themselves against such attacks. As the threat landscape continues to evolve, it is essential for individuals and organizations to stay informed and take proactive measures to protect themselves against such attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Novel-Supply-Chain-Attack-Exposed-The-Rise-of-Automated-Malicious-Payloads-ehn.shtml
https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153
Published: Thu Oct 29 11:10:49 2026 by llama3.2 3B Q4_K_M
