Rigged posts on 61 GitHub repos target CI pipeline secrets
A suspected lone attacker published 83 rigged posts across 61 GitHub repositories, including Google's LangExtract, Trivy, and Brave, in 45 minutes, according to Radware. The posts hid commands in HTML comments to make CI/CD pipelines leak secrets; Radware saw the code run twice but cannot say what was taken. Teams with pipelines tied to repo posts should review recent runs and rotate exposed secrets.
What happened
A suspected lone attacker published 83 rigged posts across 61 GitHub repositories, including Google's LangExtract, Trivy, and Brave, in 45 minutes. According to Radware, the posts hid commands in HTML comments to make CI/CD pipelines leak secrets.
Why it matters
Radware saw the malicious code run twice and cannot say what was taken. Pipeline secrets grant access to the systems that build and ship software, so companies maintaining or depending on these projects may be exposed to unauthorized access.
What to do
Check whether our repositories let outside posts or comments trigger pipelines; review the resulting runs and rotate every secret used in them.
For the technical team
- Affected
- Vários projetos de código aberto Repositórios GitHub de 61 projetos, incluindo LangExtract (Google), Trivy e Brave; pipelines CI/CD · 61 GitHub repositories, including LangExtract (Google), Trivy, and Brave; versions not stated in the source.
- Exploitation
- Exploitation reported by Radware: the code ran twice; Radware says it cannot tell what was taken.
- Fix
- Fix unconfirmed
- Vector
- Posts on GitHub repositories with commands hidden in HTML comments; CI/CD pipelines that process the posts execute the commands and leak secrets. Exact execution path not detailed in the source.
- More details
- 83 posts published in 45 minutes by a suspected lone attacker. Details reported by Radware.
Timeline
First report of the campaign, with Radware detailing the post volume and observed code execution.
Sources 1 source
- @IntCyberDigest @IntCyberDigest
