Megalodon Supply Chain Attack Compromises Over 5,500 GitHub Repositories via Malicious Actions

A significant cybersecurity incident, now known as the 'Megalodon' supply chain attack, has led to the compromise of over 5,500 GitHub repositories. Security researchers have detailed how attackers leveraged automated commits to inject malicious GitHub Actions workflows into these repositories. The campaign, which unfolded on May 18, 2026, over a concentrated six-hour period, saw more than 5,700 malicious commits pushed to 5,561 distinct repositories. The primary objective of the attack was to steal sensitive data, including CI secrets, cloud credentials, SSH keys, OIDC tokens, and other source code secrets. The injected GitHub Actions workflows contained base64-encoded bash payloads designed for this exfiltration. A particularly concerning aspect of the Megalodon attack is its exploitation of the 'workflow_dispatch' function within GitHub Actions. This allowed the attackers to create dormant backdoors that could be activated at a later date via the GitHub API, using stolen GitHub tokens. Crucially, this method reportedly circumvented GitHub's anti-recursion rules, which are typically in place to prevent workflows from spawning new runs through token-triggered events. Cybersecurity firms like SafeDep have been instrumental in detailing the mechanics of this attack, urging affected GitHub users to revert their repositories and thoroughly audit all workflow files for any signs of compromise. The incident underscores the growing threat of poisoned pipeline execution (d-PPE) attacks, where adversaries with write access inject malicious code directly into workflow definition files, compelling the CI system to execute attacker-controlled commands during subsequent pipeline runs. This event serves as a stark reminder for the open-source community and organizations relying on GitHub Actions to bolster their supply chain security practices and remain vigilant against sophisticated automated threats.