Researchers found 83 attacks on 61 open source projects, using invisible text in GitHub posts to trick automated tools into handing over passwords and keys.
Someone hid secret commands inside ordinary-looking GitHub posts and aimed them at 61 public software projects, including Trivy, MLflow and the Brave browser. The goal, researchers say, was to trick automated systems into leaking credentials. Most of the posts went up within 43 minutes on September 1.
GitHub is a site where developers store and share code. Many projects set up workflows, which are automated tasks that run when something happens, such as a new issue, comment or pull request (a proposed code change). Security firm Radware found that an attacker posted items with commands hidden in HTML comments. That text does not show up on the rendered page, so a human reader sees nothing odd.
If a project's workflow was set up carelessly, it pasted that hidden text straight into a command it was running. The command then collected environment variables, which are settings that can hold passwords and access keys, and tried to send them to a server the attacker controlled. Researcher Gabi Nakibly said the workflow fires within a second.
Radware's guess is that the real aim was a supply chain attack. In that scenario, the attacker steals a project's credentials, changes its code, and the bad code then reaches everyone who uses the software. Researcher Zvika Babo noted that these projects are used by thousands of organizations. Another worry is how easy this is. Babo said anyone with a GitHub account can try it, without breaking into the project first.
Radware counted 83 attacks, using 74 GitHub accounts. Many of those accounts had real development histories, so they were likely hijacked. The researchers suspect one person is behind it.
Everyday users of these tools have no confirmed reason to panic. The researchers found two cases showing the hidden command actually ran. They cannot say whether the attacker gained write access, changed any code or compromised software downstream. They are still looking into it.
The people who need to act are those who run public GitHub projects with automated workflows. Businesses that depend on open source tools should also pay attention, since a stolen key at one project could affect the software they rely on. The alert box above lists the steps for maintainers.
Radware told all affected maintainers. Most of the repositories were closed or fixed, but the researchers cannot confirm that every one was. The report was current as of October 13.
Nakibly said there is no way to stop attackers from trying. The defense is to make sure workflow code can withstand this kind of trick. If you use any of the named tools, watch for notices from those projects about stolen keys or unexpected code changes.
Hidden text in a public post can hijack a project's automation, so maintainers should treat outside content as untrusted and limit what automated jobs can access.
A modified Gboard called GboardWu Privacy keeps the features of Google's keyboard but stops it from sending usage data back to Google.
Read more: A modded Google keyboard keeps its features but blocks trackingA new Alibaba-led test of real coding requests found the best AI agent fully finished just 26.4 percent of tasks, so human review still matters.
Read more: AI coding helpers fully finish only about 1 in 4 real tasksOtto, a new customer-tracking app for field sales teams, lets reps speak their notes instead of typing them. Price and launch details are not yet known.
Read more: Otto launches a sales app you talk to instead of typing
