TL;DR — 15 Second Read
- →Attackers backdoored 5,561 GitHub repositories in just 6 hours by injecting malicious CI/CD workflow files that steal credentials automatically
- →The malware harvests AWS keys, SSH private keys, Google Cloud tokens, database passwords, and dozens of other secrets the moment a repository owner merges the infected commit
- →The attack was carried out using throwaway accounts with forged bot identities — making it look like routine CI maintenance to unsuspecting developers
- →Developers must immediately audit their GitHub Actions workflow files, rotate all secrets, and enable branch protection rules to prevent unauthorised commits
On May 18, 2026, attackers launched one of the most aggressive supply chain attacks ever recorded against GitHub. In just six hours, a campaign called Megalodon pushed 5,718 malicious commits across 5,561 repositories — injecting hidden code into CI/CD pipeline workflow files designed to steal every secret stored in those environments the moment a developer merged the changes.
What makes this attack particularly dangerous from a cybersecurity standpoint is how invisible it was. The attackers disguised their malicious commits as routine CI maintenance updates, using fake bot account names like build-bot, auto-ci, and pipeline-bot. To any developer glancing at their commit history, it looked like standard automated housekeeping — not a sophisticated credential theft operation targeting their cloud infrastructure, SSH access, and source code secrets at scale.
Affected products
- •Developers with public GitHub repositories using GitHub Actions
- •Organisations running self-hosted CI/CD runners
- •Any project with AWS, Google Cloud, or Azure credentials stored as GitHub Secrets
- •npm package maintainers using GitHub for publishing pipelines
- •DevOps teams using Terraform, Vault, Kubernetes, or Docker configurations stored in repositories
- •Open-source maintainers whose repositories have external contributors with push access
Step-by-step remediation
Audit every GitHub Actions workflow file in your repositories immediately. Navigate to your repository, open the .github/workflows/ folder, and review every .yml file present. Look specifically for any workflow files added or modified on May 18, 2026, that you did not create yourself. Any file you don't recognise should be treated as potentially malicious until verified.
Check your recent commit history for suspicious bot-named authors. Look for commits from accounts named build-bot, auto-ci, ci-bot, pipeline-bot, or random 8-character usernames. If you find any such commits, do not merge them under any circumstances and report them to GitHub Security immediately.
Rotate all secrets without delay if you have any reason to suspect compromise. Go to your repository Settings, then Secrets and Variables, then Actions, and regenerate every secret stored there. Do the same in your AWS IAM console, Google Cloud Console, and Azure portal for any credentials that may have been exposed through your CI/CD environment.
Enable branch protection rules on your main branch to prevent this from happening again. Go to Settings, then Branches, then Add rule. Require pull request reviews before merging and disable direct pushes from unreviewed accounts. This single setting ensures no commit reaches your main branch without human review.
Revoke and regenerate all GitHub Personal Access Tokens by going to GitHub Settings, then Developer Settings, then Personal Access Tokens. Revoke every existing token and create fresh ones with the minimum permissions necessary for each use case.
Check your package.json files for any of the nine malicious Polymarket npm packages — polymarket-trading-cli, polymarket-terminal, polymarket-trade, polymarket-auto-trade, polymarket-copy-trading, polymarket-bot, polymarket-claude-code, polymarket-ai-agent, and polymarket-trader. If any are present, remove them immediately and assume your cryptocurrency wallet private key has been stolen. Transfer any funds to a new wallet at once.
What Happened
On May 18, 2026, attackers launched one of the most aggressive supply chain attacks ever recorded against GitHub. In just six hours, a campaign called Megalodon pushed 5,718 malicious commits across 5,561 repositories — injecting hidden code into CI/CD pipeline workflow files designed to steal every secret stored in those environments the moment a developer merged the changes.
What makes this attack particularly dangerous from a cybersecurity standpoint is how invisible it was. The attackers disguised their malicious commits as routine CI maintenance updates, using fake bot account names like build-bot, auto-ci, and pipeline-bot. To any developer glancing at their commit history, it looked like standard automated housekeeping — not a sophisticated credential theft operation targeting their cloud infrastructure, SSH access, and source code secrets at scale.
The attack was carried out using throwaway GitHub accounts with randomly generated 8-character usernames. Each account forged its git author identity to display familiar bot names developers typically see in automated pipelines. Two payload variants were deployed — SysDiag, which triggered on every push and pull request, and Optimize-Build, which used manual workflow dispatch for stealth. Both achieved the same result: silent credential theft at scale through infrastructure developers already trust.
Real-World Impact
For individual developers, the consequences are severe. The malware harvests AWS credentials, Google Cloud access tokens, Azure instance metadata, SSH private keys, Docker and Kubernetes configurations, Vault tokens, Terraform credentials, shell history, API keys, database connection strings, JWT tokens, PEM private keys, and any file matching over 30 secret detection patterns — including .env files, credentials.json, and service-account.json. A single merged commit hands attackers complete access to every cloud environment, server, and database connected to that developer's pipeline.
For Indian developers and technology companies specifically, this is a direct threat to data security and business continuity. Indian IT services firms, SaaS startups, and independent developers using GitHub Actions for deployment pipelines are all exposed. A compromised AWS credential can drain cloud budgets in hours. A stolen database connection string gives attackers access to customer data, payment records, and personal information — triggering compliance and legal consequences under India's data protection framework.
The Megalodon campaign is part of a broader wave of supply chain attacks attributed to TeamPCP, a group that has already compromised TanStack, Grafana Labs, OpenAI, and Mistral AI. Their attack pattern is worm-like — one compromise feeds the next as stolen credentials unlock access to further connected systems. npm has already been forced to invalidate all granular access tokens with write access that bypass two-factor authentication in response to the ongoing threat.
Prevention Tips
Never merge a pull request or commit from an account you don't personally recognise, especially one using a bot-style name that mimics automated CI systems. Treat every new GitHub Actions workflow file as a potential network security risk until you have read every line of it yourself and confirmed its origin.
Store the minimum possible secrets in your CI/CD environment and apply the principle of least privilege across all connected systems. CI/CD runners should only have access to the credentials they absolutely need for their specific task — nothing more. Use GitHub's Trusted Publishing for npm packages instead of storing granular access tokens that can be harvested through compromised pipelines.
Enable two-factor authentication on your GitHub account and all connected cloud provider accounts as a baseline computer security requirement. Regularly audit which accounts and applications have push access to your repositories and revoke access for anything that is no longer actively contributing. Subscribe to security advisories from GitHub, npm, and your cloud providers so you receive immediate alerts when new supply chain threats targeting your digital security infrastructure are identified.
Frequently Asked Questions
How do I know if my repository was one of the 5,561 affected?
Check your repository's commit history for commits made on May 18, 2026, from accounts you don't recognise — particularly those using bot-style names like build-bot or auto-ci. Also check your .github/workflows/ folder for any workflow files added or modified on that date that you didn't create yourself. GitHub's audit log under Settings → Security → Audit Log will show you a full history of all changes.
If I never merged the malicious commit, are my secrets still safe?
Yes — the malware only executes if the workflow file is merged into your repository and triggered. If you spotted the suspicious commit and left it unmerged, your credentials were not accessed through this specific attack. However you should still rotate your secrets as a precaution since the attacker may have used other methods to access your environment.
Does this affect private repositories or only public ones?
Megalodon primarily targeted public repositories but the underlying technique works on private repositories too, particularly if attackers obtained valid Personal Access Tokens or deploy keys through other means. Any repository using GitHub Actions with stored secrets is potentially vulnerable to this attack pattern regardless of visibility settings.
What is a supply chain attack and why is it so dangerous?
A supply chain attack targets the tools and infrastructure developers use to build software rather than attacking the final product directly. Because developers inherently trust their own build pipelines and CI/CD systems, malicious code injected at this level runs with full access to every credential in the environment — credentials that often unlock production databases, cloud infrastructure, and customer data. This is what makes supply chain attacks a critical internet security threat — the trust relationship is exploited before the developer has any reason to be suspicious.
Are the malicious Polymarket npm packages still active?
As of the time of publishing this article, all nine malicious Polymarket packages remain available for download on npm. Avoid installing any package with a polymarket prefix. If you have already installed any of them, assume your wallet private key is compromised — transfer any funds to a new wallet immediately and report the incident to cybercrime.gov.in if you are based in India.
Read Next
Threat Watch
Hackers Found a Way to Bypass Your Two-Factor Authentication — Here's Exactly How
Threat Watch
CVE-2026-33626: LMDeploy SSRF Flaw Exploited in 12 Hours — Attackers Stole AWS Cloud Credentials via AI Image Loader
Threat Watch
CVE-2026-28950: Apple Patches iOS Flaw That Let FBI Extract Deleted Signal Messages From Push Notification Database
Threat Watch
GlassWorm ForceMemo: Stolen GitHub Tokens Used to Silently Inject Malware Into 240+ Python Repositories — Attack Still Active
Threat Watch