A sneaky supply-chain campaign went after CI/CD workflows through GitHub issues and pull requests.
How it worked
Radware found at least 83 attacks against 61 public repos, including Trivy, MLflow, Brave, Google’s LangExtract, Podman and discord.js. 77 of them went up in a 43-minute window on Sept 1, from 74 accounts, many of which look compromised. The attacker hid commands in HTML comments inside issues, PRs and comments, so they didn’t show on the page. If a workflow was triggered by those events and pasted that text into a shell step, the command ran and tried to send environment variables to an attacker’s server. Radware found two runs where the payload executed but can’t yet say whether the attacker got write access.
What to check
- Never interpolate issue or PR text (like titles, bodies or comments) directly into
run:steps. Pass it through environment variables instead. - Give workflow tokens the least permission they need, and keep secrets out of workflows triggered by untrusted events.
My take
Anyone with a GitHub account can try this. Go audit your workflows.
God Bless, and Needs Garlic!
