Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour

Radware researchers report at least 83 attacks on 61 public GitHub repositories, including Trivy, MLflow, Brave and Google LangExtract, with 77 of them posted within 43 minutes on September 1. Malicious commands were hidden in HTML comments inside issues, pull requests or comments, aiming to run in CI/CD workflows and steal credentials. Radware suspects one coordinated attacker using 74 likely compromised accounts. The findings are Radware's own assessment, with no independent confirmation cited. Teams should review which events trigger their workflows.