Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets

Key facts for GitHub Actions injection campaign

Detection coverage for GitHub Actions injection campaign

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5030 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GitHub Actions Runner Env Dump → Base64 → curl Chain (CI/CD Secret Exfiltration)

Detects the injected GitHub Actions command-substitution payload from the TL-2026-5030 campaign (Radware: 83 malicious issues/PRs/comments across 61 repos) executing on a self-hosted runner: within one minute a runner step script spawns env/printenv, base64 and curl. The payload dumps runner secrets with env, Base64-encodes them and POSTs them to 54.205.16.142:8443. Flags the chain by behaviour and marks hits whose command line references the known exfil IP/port.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1195.002, T1059.004, T1552, T1132.001
• Data sources: sysmon_for_linux, linux_auditd, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" earliest=-24h EventCode=1
(Image="*/env" OR Image="*/printenv" OR Image="*/base64" OR Image="*/tr" OR Image="*/curl")
(ParentCommandLine="*/_temp/*" OR ParentCommandLine="*/_work/*")
| eval proc=replace(Image,"^.*/","")
| bin _time span=1m
| stats values(proc) as procs values(CommandLine) as cmdlines min(_time) as first_seen by host User _time
| where isnotnull(mvfind(procs,"^(env|printenv)$")) AND isnotnull(mvfind(procs,"^base64$")) AND isnotnull(mvfind(procs,"^curl$"))
| eval cmd_blob=mvjoin(cmdlines," ")
| eval ioc_hit=if(like(cmd_blob,"%54.205.16.142%") OR like(cmd_blob,"%:8443%"),"yes","no")
| convert ctime(first_seen)
| table first_seen host User procs cmdlines ioc_hit

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("env", "printenv", "base64", "tr", "curl")
| where InitiatingProcessCommandLine has_any ("/_temp/", "/_work/")
| summarize Procs=make_set(tolower(FileName)), CmdLines=make_set(ProcessCommandLine, 25), FirstSeen=min(Timestamp) by DeviceName, AccountName, Window=bin(Timestamp, 1m)
| where (set_has_element(Procs, "env") or set_has_element(Procs, "printenv")) and set_has_element(Procs, "base64") and set_has_element(Procs, "curl")
| extend IocHit = tostring(CmdLines) has_any ("54.205.16.142", ":8443")
| project FirstSeen, DeviceName, AccountName, Procs, CmdLines, IocHit

Sigma

title: GitHub Actions Runner Step Script Spawns curl POST With Inline Data
id: 7d3f2a91-5c4e-4b86-9a1d-0e6b8f3c2a10
status: experimental
description: Detects curl spawned from a GitHub Actions runner step script posting inline data, as in the TL-2026-5030 command-injection campaign exfiltrating Base64-encoded environment variables.
references:
  - https://www.radware.com/blog/inside-a-github-supply-chain-attack-campaign/
  - https://cybersecuritynews.com/hackers-target-61-github-repositories/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.initial-access
  - attack.t1190
  - attack.t1195.002
  - attack.execution
  - attack.t1059.004
  - attack.credential-access
  - attack.t1552
  - attack.command-and-control
  - attack.t1132.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - '/_temp/'
      - '/_work/'
  selection_curl:
    Image|endswith: '/curl'
  selection_post:
    CommandLine|contains:
      - ' -d '
      - '--data'
      - '-X POST'
  condition: all of selection_*
falsepositives:
  - Legitimate workflow steps that POST build status or webhooks with curl (allowlist destination hosts)
level: high

Known false positives:

• Legitimate CI steps that dump env for debugging and curl a known notification/webhook endpoint
• Release workflows posting build metadata to internal artifact services

Tuning notes: Applies to self-hosted runners with Sysmon for Linux/auditd telemetry (GitHub-hosted runners are not observable). Adjust the index/sourcetype to your environment, allowlist known runner hosts and approved webhook destinations, and raise priority when ioc_hit=yes. Widen span=1m if step scripts run slowly.

• 🔒 GitHub Actions Step curl POST to IP-Literal HTTP Endpoint (Injected Exfil) · unlock with TL Creds
• 🔒 Shell Command Line Piping Environment Into base64 or Reading /proc/*/environ · unlock with TL Creds
• 🔒 curl HTTP POST to IP-Literal URL from CI Runner (Non-TLS Exfil Pattern) · unlock with TL Creds
• 🔒 GitHub Actions Runner Script Spawns base64 Encoder (Env Encoding Stage) · unlock with TL Creds
• 🔒 GitHub Actions Runner Script Strips Newlines With tr -d (Payload Encoding Cleanup) · unlock with TL Creds
• 🔒 curl Process Connection to [indicator] or Port 8443 (Host-Level Exfil) · unlock with TL Creds
• 🔒 CI Runner Secret Staging: env + Newline Strip + base64 Without Network Stage · unlock with TL Creds
• 🔒 Network Egress to TL-2026-5030 Exfil Endpoint [indicator]:8443 · unlock with TL Creds

Indicators of compromise for GitHub Actions injection campaign

As of 2026-11-02, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-5030.

Sample indicators (1 of 14)

• IP address: 54.205.16[.]142

Defanged, TLP:CLEAR. Full set of 14 indicators: unlock with TL Creds.

How GitHub Actions injection campaign works

On 2026-09-01 an apparently single actor published 83 verified malicious items (59 issues and 24 pull requests) across 61 public GitHub repositories using 74 distinct accounts. Radware noted that many of the accounts had development histories that looked legitimate; secondary reporting suggests some may have been compromised, which Radware did not establish. Targets included google/langextract, aquasecurity/trivy, brave/brave-browser, mlflow, ToolJet/ToolJet, PX4/PX4-Autopilot, Snouzy/workout-cool, agno-agi/agno, Homebrew/homebrew-cask and github/docs. 77 of the 83 items were posted in about 43 minutes (reported as 11:26:51 to 12:10:00 UTC) and the remaining 6 about 2 minutes later, roughly 1.8 malicious posts per minute in the first wave. The 16 most popular targeted repositories hold roughly 460,600 GitHub stars in total.

The attack relies on shell command injection through untrusted GitHub content processed by GitHub Actions. The payload is a Bash command substitution $() placed in an issue or pull request title (31 items), body (17 items) or comment (35 items). According to Radware's analysis as reported by secondary sources, the commands were hidden inside HTML comments so they do not appear on the rendered page, while workflows still ingest the raw text. Workflows that place this text directly into shell source, notably title-checking and notification workflows, expand the substitution and run the attacker's command inside the runner; the triggered workflow starts within about a second of the event, so a vulnerable workflow executes the payload almost immediately.

The observed command runs env to collect the runner environment (which can include CI/CD secrets and tokens), removes newlines, Base64-encodes the result and uses curl to send an HTTP POST to 54.205.16.142 on port 8443. All verified payloads pointed to this destination. The connection is plain HTTP rather than HTTPS, and each attempt carries a unique collection identifier. Radware examined actual workflow run logs and found two prominent cases with direct evidence that the command executed in the automation environment. Radware could not confirm that the attacker gained write permissions, modified repositories, compromised distributed code, or obtained usable credentials. By 2026-10-13, about 42% of the items (35 of 83) were still open.

No CVE, named threat actor or malware family is associated with this campaign. The weakness is insecure workflow design (CWE-77/CWE-78 style injection of untrusted input into shell code). Recommended defenses are to treat all GitHub-sourced text as untrusted, pass it to scripts via environment variables rather than interpolating it into shell source, avoid eval, restrict workflow token permissions and secret exposure, and separate notification jobs from privileged release workflows. Note: the Radware blog could not be retrieved directly (browser verification page), so campaign details come from the Cyber Security News article and three secondary reports that cite the Radware research.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1119 Automated Collection

Defense Evasion

T1027 Obfuscated Files or Information

Exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Execution

T1059.004 Unix Shell

Command and Control

T1071.001 Web Protocols; T1132.001 Standard Encoding

Initial Access

T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain

Credential Access

T1552 Unsecured Credentials

Resource Development

T1585 Establish Accounts

Remediation for GitHub Actions injection campaign

Immediate actions

• Block egress to 54.205.16.142 (TCP/8443) from CI runners and network perimeter and search proxy/firewall logs for it
• Audit GitHub Actions run logs for workflows triggered by the malicious issues, pull requests and comments, especially title-checking and notification workflows
• Rotate secrets and tokens exposed to any workflow run that processed an affected item
• Close or delete malicious issues, pull requests and comments, and review repositories for $() or backtick content in titles, bodies and comments, including inside HTML comments
• Review audit logs for suspicious activity around 2026-09-01 11:26-12:12 UTC

Workarounds

• Pass untrusted values through environment variables instead of interpolating them into shell source
• Avoid eval and similar dynamic execution of workflow-supplied text
• Require maintainer approval before workflows run for first-time or external contributors

Longer-term hardening

• Treat all GitHub-sourced text (titles, bodies, comments, branch names) as untrusted data
• Separate notification and triage jobs from privileged release workflows and limit secrets available to externally triggered jobs
• Set default GITHUB_TOKEN permissions to read-only and grant write scopes per job
• Add static analysis of workflows for script injection patterns such as direct ${{ github.event.* }} expansion in run steps
• Restrict outbound network access from CI runners to an allowlist

Affected and fixed versions

• GitHub — GitHub Actions workflows that interpolate user-controlled issue, pull request or comment text into shell scripts
  Vulnerable versions: Workflow-specific; not a product version flaw
  Fixed in: Workflows that pass untrusted input via environment variables
• Google — LangExtract (google/langextract)
  Vulnerable versions: Targeted repository; compromise not confirmed
• Aqua Security — Trivy (aquasecurity/trivy)
  Vulnerable versions: Targeted repository; compromise not confirmed
• Brave — Brave Browser (brave/brave-browser)
  Vulnerable versions: Targeted repository; compromise not confirmed
• ToolJet — ToolJet (ToolJet/ToolJet)
  Vulnerable versions: Targeted repository; compromise not confirmed
• PX4 — PX4-Autopilot (PX4/PX4-Autopilot)
  Vulnerable versions: Targeted repository; compromise not confirmed

Timeline of GitHub Actions injection campaign

• 2026-09-01 Injected commands run env, strip newlines, Base64-encode the output and attempt an HTTP POST with locked-ioc-14 to locked-ioc-10:8443, each carrying a unique collection identifier; theft of usable secrets is not confirmed.
• 2026-09-01 Vulnerable locked-ioc-9 workflows start within about a second of each event; Radware finds two cases in run logs with direct evidence the injected command executed in the automation environment.
• 2026-09-01 6 further malicious items are posted about 2 minutes after the first wave, bringing the total to 83 items (59 issues, 24 pull requests) across 61 repositories from 74 accounts.
• 2026-09-01 77 of the 83 malicious items are posted in about 43 minutes (reported window 11:26:51 to 12:10:00 UTC, roughly 1.8 posts per minute) across dozens of repositories, including locked-ioc-5, locked-ioc-6 and locked-ioc-3.
• 2026-09-01 Malicious issues, pull requests and comments begin appearing against public GitHub repositories; all 83 verified items are published on this date (Radware).
• 2026-10-13 About 42% of the malicious items (35 of 83) remain open on GitHub as of this date, per reporting on the Radware research.
• 2026-11-02 Cyber Security News publishes the Radware findings: command execution evidenced in two workflow runs, secret theft and repository compromise not confirmed.

Sources cited for GitHub Actions injection campaign

• Radware: Inside a GitHub Supply Chain Attack Campaign radware.com · Research
• Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets cybersecuritynews.com · News · 2026-11-02
• Google's LangExtract Among 61 Repos Targeted in 43 Minutes fourweekmba.com · News
• GitHub bajo ataque: 61 repositorios expuestos a una campaña de cadena de suministro diariobitcoin.com · News
• Hidden GitHub comments hit 61 repositories (news digest) freemalta.com · News

More in supply chain

• Binance Wallet Infrastructure Compromise via Fake Job Interviews, Trojanized Homebrew Installer and Internal AI Tool Abuse (~$6.3B Theft, TraderTraitor)
• cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes (OPSSHIELD Supply-Chain Compromise)
• Haiou Jailbreak Bundle: 'Prompt Adware' Persistently Altering AI Coding Agent Instructions to Promote LLM Gateway (zz.aiapi2025.top)
• XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by Google
• Compromised Injective SDK npm Package (@injectivelabs/sdk-ts 1.20.21) Exfiltrates Cryptocurrency Wallet Keys

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages