Exploitation Campaign of Vulnerable GitHub Workflows

An unknown threat actor has been conducting an opportunistic campaign of automated malicious pull requests to attempt to initiate supply chain compromise against various open source repositories. In at least two cases, the attacker has been able to inject malicious code that ultimately led to malicious npm package releases. However, so far the vast majority of attempts have been unsuccessful, with a success rate of 10%. This campaign has already targeted more than 200 repositories, and appears to be ongoing as of 2026-04-03.

Analysis of the campaign so far suggests that it is likely AI-enabled, due to the frequency of deployment (~7 PRs per hour) and the adaptive nature of the attacker's techniques:

• Identifies language, framework, test runner, CI config.
• Dynamically selects an injection point in the form of the file that will execute during CI.
• Creates idiomatic code as a wrapper for the detected language
• Optimizes triggers by injecting npm scripts into multiple hooks