Poisoned Pipeline / Incidents / AS91
Megalodon mass GitHub repo backdooring via CI
SafeDep named Megalodon: mass backdooring of GitHub repositories
through CI workflows (malicious workflow files that steal secrets and
persist). Same class as hackerbot-claw (AS75) and Nx s1ngularity
(AS74), as a named campaign rather than a single package.
Mapped techniques
- T0147 Scan public CI/CD configurations for secrets and vulnerable actions
- T0166 Trigger pipeline execution
- T0140 Harvest tokens from environment variables
supply-chain mass workflow implant
Repos selected for vulnerable or writable workflows.
Implanted GitHub Actions workflows.
CI secrets from the poisoned workflows.