Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets
Hackers targeted 61 GitHub repos with command injection to steal CI/CD secrets.
A coordinated campaign targeted 61 public GitHub repositories using command injection attacks within GitHub Actions workflows to steal CI/CD secrets. Attackers posted malicious issues, pull requests, and comments containing Bash command substitution expressions, which were executed by vulnerable workflows. While Radware researchers did not confirm stolen secrets, the attack exploited a common vulnerability in how user-controlled text is handled in shell scripts, highlighting risks to software build systems.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitHub?
Get an email when a new story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited a widespread misconfiguration in GitHub Actions workflows where user-controlled input—such as issue titles, pull request bodies, and comments—was passed directly into shell scripts without sanitization, enabling command injection. This campaign targeted 61 public repositories, demonstrating that insecure CI/CD pipeline design is a systemic, not isolated, problem. The attack vector is particularly dangerous because CI/CD environments often hold highly privileged secrets such as API keys, deployment credentials, and cloud access tokens. Compromising these secrets can cascade into full supply chain attacks, potentially affecting downstream users of the targeted software.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 54.205.16.142
- mitre_attack — T1059.004
- mitre_attack — T1552.001