Security researchers have disclosed details of a large-scale automated campaign, tracked as Megalodon, that pushed 5,718 malicious commits to 5,561 distinct GitHub repositories within a single six-hour window. According to a report from supply-chain security firm SafeDep, the commits landed on May 18, 2026, between 11:36 a.m. and 5:48 p.m. UTC, poisoning open-source projects with code designed to steal secrets at scale.
How the campaign worked
The attacker used throwaway GitHub accounts with random eight-character usernames and forged author identities such as build-bot, auto-ci, ci-bot and pipeline-bot, cycling through seven commit messages that mimicked routine continuous-integration maintenance. Each commit injected a GitHub Actions workflow containing a base64-encoded bash payload. Once a repository owner merged the change, the malware executed inside their CI/CD pipeline and could spread further in a worm-like fashion.
A wide net of stolen secrets
The payloads were built to exfiltrate a broad range of credentials to a command-and-control server, including CI environment variables, Amazon Web Services keys, Google Cloud and Microsoft Azure instance-metadata tokens, SSH private keys, OIDC tokens, Docker and Kubernetes configurations, Vault and Terraform credentials, and GitHub, GitLab and Bitbucket tokens. Researchers observed two variants: SysDiag, a mass version triggered on every push and pull request, and Optimize-Build, a stealthier variant activated only through a manual workflow trigger. The npm package @tiledesk/tiledesk-server was among those affected.
Linked to a wider supply-chain wave
Researchers tied Megalodon to the activity cluster known as TeamPCP, the same group behind a string of recent open-source compromises. It is a separate operation from the earlier breach we covered in which TeamPCP exfiltrated GitHub repositories through a poisoned VS Code extension. "We've entered a new supply chain attack era, and TeamPCP compromising GitHub was only the beginning," OX Security's Moshe Siman Tov Bustan said, warning of "an endless wave" of attacks aimed at developers.
Industry response
The fallout has prompted npm to invalidate granular access tokens with write access that bypass two-factor authentication, and to urge maintainers to adopt Trusted Publishing to reduce reliance on long-lived tokens. The incident follows other recent enforcement and disruption actions against malicious infrastructure, including the global takedown of the First VPN cybercrime service and Microsoft's effort to disrupt the Fox Tempest malware-signing operation. Security teams are advised to audit their GitHub Actions workflows for unexpected commits and to rotate any credentials that may have been exposed.
Reporting based on coverage from The Hacker News, citing SafeDep and OX Security.