Megalodon: more than 5,500 GitHub repositories infected via fake CI commits

More than 5,500 GitHub repositories have been reported infected after attackers pushed over 5,700 fake CI commits. The commits planted GitHub Actions workflows that stole CI secrets, cloud credentials, SSH keys, tokens and secrets held in source code.

SafeDep describes the campaign, named Megalodon, as using both immediately executing variants and dormant backdoors. Compromised Tiledesk repositories later led to poisoned npm releases being propagated onward.

What this means for your business

The build environment usually holds broader access than any single employee. A workflow running in CI can reach production, the cloud account and the signing keys. And because the attack arrives as a change to a workflow file, it looks like ordinary development activity in the log. Organisations building software in GitHub should review recent workflow changes rather than simply scanning for known malware.

Berigo recommends

• Review all recent changes under .github/workflows, paying particular attention to commits nobody can account for.
• Rotate CI secrets and cloud credentials in every repository where suspicious commits landed.
• Require mandatory review of workflow file changes, under stricter rules than ordinary code.
• Limit what access build jobs receive, and make those credentials short-lived rather than permanent.

Source

• securityweek.com
• safedep.io