Hidden commands in GitHub issues hit 61 open source repos

Researchers at Radware have identified at least 83 malicious GitHub issues, pull requests and comments aimed at 61 public repositories, in what they describe as a coordinated campaign to run commands inside automated build systems and steal credentials. Almost all of it happened on 1 September 2026. According to Radware, 77 of the malicious items were published in a 43-minute window, with the remaining six appearing in the next two minutes. The targets included Google's LangExtract, the Trivy security scanner, the Brave browser and MLflow.

The attack chain is simple and needs no access to the target project. The attacker posts an issue, pull request or comment containing shell commands hidden inside HTML comments, so the text does not appear on the rendered page. If the repository is configured to run a workflow when such an event occurs, the automation starts within a second. Where the workflow pastes attacker-controlled text straight into shell code, the shell runs the hidden command, which collects environment variables and tries to send them to a server controlled by the attacker.

Radware researcher Zvika Babo told The Register that the attacker "doesn't need to compromise the repository or to have access to its codebase" to attempt this, adding that "basically, every user with a GitHub account can try to run this attack". The team found the campaign while investigating prompt injection on GitHub, where untrusted text is fed into a system that then acts on it.

The activity was spread across 74 different GitHub accounts, many with genuine development histories, which the researchers said suggests the accounts were compromised. "Considering that dozens of accounts posted the same type of payload, on the same day, within a narrow time window, and to the same infrastructure, it is reasonable to assess that the activity was coordinated," the Radware team wrote in research shared with The Register. Researchers Gabi Nakibly and Babo said they suspect a single individual is responsible.

Nakibly said the likely goal was a supply-chain attack, in which stolen repository credentials would let the attacker alter code and push it on to downstream users. The researchers examined logs from real workflow runs and found two cases with evidence that the malicious command executed inside the automation environment. They said they cannot confirm whether the attacker obtained write permissions, changed source code or compromised any downstream software.

The affected repositories span AI frameworks, security tools, development infrastructure and databases. Radware's list of the most popular includes agno-agi/agno with 42,700 stars, ToolJet with 41,100, google/langextract with 38,900, aquasecurity/trivy with 38,400, CopilotKit with 38,000 and podman with 33,000. Other named targets include QwenLM/qwen-code, mlflow/mlflow, discord.js, cilium, brave/brave-browser, dotnet/maui, Homebrew/homebrew-cask, github/docs, apache/doris and PX4-Autopilot. The researchers counted 83 items with a verified payload as of 13 October 2026.

Radware said it disclosed the findings to all the affected maintainers, and that most of the repositories were closed or fixed, though it cannot confirm all of them were. "There is no way to stop the attackers from attempting," Nakibly said. "The only way is to make sure that the workflow code is resilient, and not vulnerable to such attacks." The researchers recommend least-privilege access for build workflows, and keeping workflows triggered by outside events separate from jobs with elevated permissions. Babo said developers should treat external content as untrusted and limit the secrets and environment variables a workflow can see.