Discover Top Posts Tagged with #supplychainattack

Hijacked npm Package Lets Hackers Run Code on Your System

Attackers slipped malicious code into the npm package is, downloaded millions of times weekly, giving them a live remote shell on developers’ machines. Linked to a wider phishing campaign, this attack shows why unchecked updates can be disastrous.

Source: Socket

Read more: CyberSecBrief

#Cryptocurrency #ExchangeHack #HotWallet #SupplyChainAttack #Cybersecurity

NPM is not safe

If you use NPM, you need to see this. Highlights security risks that many ignore.

#CyberSecurity #Hacking #OpenSource #SupplyChainAttack #NorthKorea #Malware #Youtube

GitHub breach: The development ecosystem is in the hot seat

TeamPCP hacked internal GitHub repos via poisoned VS Code extension, stealing 4K private repos & demanding $50K ransom. https://jpmellojr.blogspot.com/2026/05/github-breach-development-ecosystem-is.html

#GitHub #TeamPCP #SupplyChainAttack #AppSec #DevSecOps

Megalodon Supply Chain Attack Infects 5,500 GitHub Repositories via CI/CD Pipelines

In a startling display of automated aggression, a supply chain attack dubbed "Megalodon" has infected over 5,500 GitHub repositories in a single six-hour window. Discovered by cybersecurity researchers at SafeDep on May 18, 2026, this campaign represents a significant escalation in the targeting of CI/CD pipelines, leveraging a technique known as direct Poisoned Pipeline Execution (d-PPE) to harvest sensitive credentials at scale.

The Attack Vector: Direct Poisoned Pipeline Execution

Unlike traditional supply chain attacks that compromise package dependencies, Megalodon targeted the build process itself. Attackers utilized accounts with write access to inject malicious GitHub Actions workflows directly into repository definitions. When these workflows executed, they triggered attacker-controlled commands designed to exfiltrate secrets from the CI/CD environment.

The primary targets were high-value credentials, including:

- Cloud Provider Keys: AWS, Google Cloud, and Microsoft Azure credentials. - Authentication Tokens: SSH keys, API tokens, and GitHub Actions OIDC tokens. - Deployment Secrets: Environment variables used for production deployments.

Automation and Evasion Tactics

The Megalodon campaign was characterized by its industrial-scale automation. Attackers deployed a network of fake GitHub accounts with random eight-character names, often impersonating automated services such as "build-bot," "auto-ci," and "pipeline-bot."

SafeDep analysis identified two primary infection methods:

- SysDiag: Adding a new, seemingly benign workflow file that exfiltrates data in the background. - Optimize-Build: Replacing existing system files with a dormant backdoor that can be activated remotely via the GitHub API.

Real-World Impact: The Tiledesk Incident

The downstream consequences of Megalodon extend beyond code repositories. Live chat and chatbot service Tiledesk was a notable victim, with hackers compromising nine of its GitHub code areas. This led to the unintentional publication of seven infected versions of their product to the public npm package registry, effectively spreading the infection from the source code level to the package ecosystem.

GitHub's Security Posture

While GitHub has not publicly commented on the Megalodon attack specifically, the incident coincides with a separate disclosure regarding unauthorized access to approximately 3,800 internal GitHub-owned repositories via a compromised employee device. This dual revelation underscores a critical vulnerability in the software supply chain: even platforms designed for secure development are not immune to credential-based attacks.

For developers and maintainers, we recommend:

- Audit Workflow Files: Review all .github/workflows files for unauthorized changes or suspicious job steps. - Rotate Secrets: Immediately rotate any cloud credentials, API tokens, or SSH keys that may have been exposed to CI/CD pipelines. - Pin Actions: Use SHA-hashed references for GitHub Actions instead of version tags to prevent tampering. - Review Commit History: Look for commits from unknown accounts, especially those with bot-like names pushing workflow changes.

#ci-cd-security #cybersecurity #devops-security #github #SupplyChainAttack

NPM is not safe

Just watched this—turns out NPM isn’t as safe as we thought. Here’s what you need to know."

#CyberSecurity #Hacking #OpenSource #SupplyChainAttack #NorthKorea #Youtube