# GitHub Issues/PR Comment Injection Supply-Chain Campaign Targeting 61 Public Repositories via Vulnerable Workflows

> A suspected single operator using 74 GitHub accounts (many apparently compromised) published 83 issues, pull requests and comments across 61 public repositories carrying malicious shell commands hidden in HTML comments. Vulnerable GitHub Actions workflows interpolated the attacker-controlled content into shell source, executing the commands and attempting to exfiltrate environment variables to an attacker-controlled server. Reported by Radware researchers.

- **Published:** 2026-10-29T12:32:12Z
- **Last reviewed:** 2026-10-29T12:32:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4738
- **ID:** TL-2026-4738
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Radware threat hunters Gabi Nakibly and Zvika Babo identified a campaign in which an attacker publishes an issue, pull request or comment on a public GitHub repository containing malicious commands hidden inside HTML comments. The hidden text is invisible when the item is rendered on GitHub, but is present in the raw body that GitHub Actions exposes to workflows through event context.

Workflows that incorporate this attacker-controlled content directly into shell source code (script injection) run the hidden command. Per the reporting, the command collects the runner's environment variables and attempts to send them to an attacker-controlled server. Environment variables in CI frequently hold secrets such as tokens and API keys, so a successful run can yield credentials that enable further repository or downstream supply-chain compromise. Nakibly noted that the workflow is triggered automatically within a second, and if it is vulnerable the attack succeeds.

The campaign was fast and concentrated. On 2026-09-01, 77 malicious items were published within a 43-minute window; the remaining 6 were published within two minutes during the 2026-09-01 to 2026-09-03 period. A single operator is suspected. The 74 accounts used mostly had legitimate development histories, which suggests many were compromised rather than newly created. By 2026-10-13 Radware had identified 83 items with a verified payload across 61 repositories. Reported high-profile targets include agno-agi/agno, ToolJet/ToolJet, google/langextract, aquasecurity/trivy, brave/brave-browser and mlflow/mlflow, with discordjs/discord.js, cilium/cilium, dotnet/maui and Homebrew/homebrew-cask also named in the hunt context.

The public reporting does not disclose the exfiltration endpoint, exact payload commands, account names, or any CVE. The primary Radware report could not be retrieved at the time of research; this record is based on The Register's coverage of it. Radware's related GitHub-wide scan of indirect prompt injection (github.com/rdwr-gabin/github-ipi-in-the-wild) is a separate measurement study and did not describe this campaign in the retrievable content. Defender guidance from the source: apply least-privilege to CI/CD workflows, separate workflows triggered by external events from jobs with elevated permissions, treat external content as untrusted, and limit secrets and environment variables available to workflows.

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials

## Sources

- [Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour (The Register)](https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153)
- [Who Is Prompt-Injecting Coding Agents? A Scan of 86 Million GitHub Items (Radware research coverage)](https://www.cybrsecmedia.com/who-is-prompt-injecting-coding-agents-a-scan-of-86-million-github-items/)
- [Radware github-ipi-in-the-wild research repository](https://github.com/rdwr-gabin/github-ipi-in-the-wild)
- [GitHub Security Lab: Keeping your GitHub Actions and workflows secure - untrusted input](https://securitylab.github.com/resources/github-actions-untrusted-input/)
- [GitHub Docs: Security hardening for GitHub Actions - script injections](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4738