Megalodon cyberattack infects 5,500 GitHub repositories, report says

A new report in Security Week warns about a cyberattack that infected 5,561 GitHub open-source repositories with malware.

Cybersecurity researchers at SafeDep detailed how the May 18 supply chain attack, dubbed Megalodon, took advantage of GitHub Actions workflows to ultimately harvest user credentials and other data. A full list of the compromised GitHub repositories is available in the SafeDep security report.

The report also details how the hackers pulled off the attack:

On May 18, 2026, an automated campaign codenamed megalodon pushed 5,718 malicious commits to 5,561 GitHub repositories in a six-hour window. Using throwaway accounts and forged author identities (build-bot, auto-ci, ci-bot, pipeline-bot), the attacker injected GitHub Actions workflows containing base64-encoded bash payloads that exfiltrate CI secrets, cloud credentials, SSH keys, OIDC tokens, and source code secrets to a C2 server at 216.126.225.129:8443.

A blog post at StepSecurity also documented the details of the attack.

"Megalodon is a textbook direct Poisoned Pipeline Execution (d-PPE) attack, a class of CI/CD attack where an adversary with write access to a repository injects malicious code directly into workflow definition files, causing the CI system to execute attacker-controlled commands on the next pipeline run," the blog post reads. (Emphasis in original.)

SafeDep researchers warned GitHub users affected by the attack to revert their repositories and audit all workflow files.

On May 20, GitHub published a blog post about unauthorized access to GitHub-owned repositories via a compromised employee device, but the company hasn't said anything about the alleged Megalodon attack.

However, on April 1, the company published a blog post detailing a new trend of cyberattacks on the open-source supply chain, which often begin by compromising GitHub Actions workflows, as in the Megalodon attack. The blog post includes tips for open-source projects on how "to secure your GitHub Actions workflows" to prevent exactly these types of attacks in the future.