Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows
An automated campaign called Megalodon pushed 5,718 malicious commits to 5,561 GitHub repos in six hours, injecting Actions workflows that exfiltrate CI secrets and cloud credentials. SafeDep identified two payload variants — a mass variant and a dormant backdoor — with one impacted npm package propagating the malware.