Radware: 83 attacks hit 61 GitHub repos in under an hour

Radware researchers uncovered a coordinated campaign of 83 attacks against 61 public GitHub repositories, including LangExtract, Trivy, Brave and MLflow. Attackers hid commands in HTML comments within issues and pull requests to execute code in CI/CD workflows and steal credentials; 77 malicious items appeared within 43 minutes on September 1.

• 77 malicious items posted within 43 minutes on September 1, six more in two minutes
• Campaign used 74 GitHub accounts, many with legitimate histories
• Targets include agno, ToolJet, Trivy, CopilotKit, podman, qwen-code, MLflow, Brave
• Payloads hidden in HTML comments, triggered by workflow events