Megalodon GitHub Actions Supply Chain Campaign — 5,561 Repositories Compromised, @tiledesk/tiledesk-server npm Backdoor (CI Credential Harvester) — Threadlinqs Intelligence
As of 2026-05-30, Megalodon GitHub Actions Supply Chain Campaign — 5,561 Repositories Compromised, @tiledesk/tiledesk-server npm Backdoor (CI Credential Harvester) is a critical-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-0556 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Between 11:36-17:48 UTC on 2026-05-18, an automated supply chain campaign codenamed 'Megalodon' pushed 5,718 malicious commits to 5,561 GitHub repositories, injecting two GitHub Actions workflow
## Overview
Megalodon is a six-hour, fully automated GitHub Actions supply chain campaign observed on 2026-05-18 in which throwaway GitHub accounts pushed 5,718 malicious commits across 5,561 public repositories, embedding two distinct GitHub Actions workflow variants that exfiltrate CI environment secrets and short-lived cloud credentials to a single hard-coded C2 endpoint (216.126.225.129:8443). The campaign was discovered by SafeDep's Malysis engine after the base64-encoded payload was bundled into an npm release of @tiledesk/tiledesk-server (a popular open-source customer support / messaging server), confirming downstream propagation from the GitHub Actions worm into the public npm ecosystem.
## Attack Chain
**1. Resource development.** The operator(s) provisioned a fleet of throwaway GitHub accounts whose usernames follow a randomized 8-character pattern, paired with two boilerplate commit author identities (build-system@noreply.dev / ci-bot@automated.dev) and four rotating author display names (build-bot, auto-ci, ci-bot, pipeline-bot). A single dedicated VPS at 216.126.225.129 was stood up on TCP/8443 to receive exfiltration traffic.
**2. Initial access via workflow injection.** Targeted repositories were selected en masse (likely via GitHub code search and language filters). For each repo, the worm pushed a malicious commit whose message imitated routine CI hygiene work — 'ci: add build optimization step' or 'chore: optimize pipeline runtime' — to evade casual review. Two workflow variants were observed:
- **SysDiag (mass variant)** — written to `.github/workflows/ci.yml`, triggered on `push` and `pull_request_target`. The `pull_request_target` trigger is critical because it runs with the base repository's secrets and write tokens even when fired by an untrusted fork PR, a recurring high-severity GitHub Actions footgun.
- **Optimize-Build (targeted variant)** — uses `workflow_dispatch` so the workflow lies dormant and is only triggered manually by the attacker on chosen victims. This gives Megalodon on-demand re-entry into the victim's CI without producing noisy automatic runs.
**3. Elevated permission grant.** Both variants explicitly request `permissions: id-token: write` and `actions: read`. The id-token write capability is what lets the workflow mint a GitHub OIDC ID token that can be exchanged for short-lived cloud credentials in AWS (`sts:AssumeRoleWithWebIdentity`), GCP (Workload Identity Federation), and Azure (federated credentials) — i.e. cloud identity impersonation without ever needing a long-lived secret in the repo.
**4. Payload execution.** Each workflow embeds a base64-encoded bash payload (~111 lines decoded) that performs:
- Enumeration of every `env` variable in the Actions runner, plus `/proc/*/environ` and PID 1 environment data to capture secrets injected by parent processes.
- Collection of all AWS access keys, secret keys, and session tokens from every configured profile (`~/.aws/credentials`, `~/.aws/config`).
- Queries of cloud instance metadata services: AWS IMDSv2, GCP metadata, Azure IMDS to lift instance role credentials.
- `gcloud auth print-access-token` to obtain GCP user / service-account tokens.
- Minting of a GitHub OIDC token via the `ACTIONS_ID_TOKEN_REQUEST_URL` / `ACTIONS_ID_TOKEN_REQUEST_TOKEN` runner variables, POSTed alongside the harvested bundle so the operator can later impersonate the repo's federated cloud identity.
- Collection of SSH private keys (`~/.ssh/id_*`), Docker auth configs (`~/.docker/config.json`), `.npmrc`, `.netrc`, Kubernetes kubeconfigs, Vault tokens, and Terraform credentials.
- A source-tree grep across 30+ regex patterns matching generic API keys, JWTs, PEM-encoded private keys, database connection strings, and known cloud-provider token formats (AWS AKIA*, ASIA*, Google AIza*, GitHub ghp_*, Slack xox*).
**5. Exfiltration.** All collected secrets are bundled and POSTed over TLS to `https://216.126.225.129:8443/`. The use of a raw IP plus a hig
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357, CWE-1395
Target sectors: technology, software-development, open-source, saas, cloud-services, devops
Target regions: Global
Detections & IOCs
As of 2026-08-15, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1583, T1585, T1587, T1586, T1195, T1078, T1059, T1204, T1546, T1505
