SIX HOURS. That is how long it took for a supply chain attack campaign researchers have named Megalodon to compromise more than 5,500 GitHub repositories. The operation targeted the CI/CD pipelines that development teams rely on to build, test, and deploy software and it used GitHub’s own trusted infrastructure to do it.

Supply chain attacks have been growing in frequency and sophistication since the SolarWinds incident of 2020. Megalodon represents a significant escalation in both speed and scale, and the attack vector it exploits malicious GitHub Actions is one that the majority of development organisations have not yet treated as a critical security surface.

What Megalodon Did

The attack campaign operated by injecting malicious GitHub Actions workflows into repositories. GitHub Actions is a CI/CD automation platform that allows developers to define automated tasks running tests, building containers, deploying code that execute every time a code change is pushed or a pull request is opened.

The malicious workflows inserted by Megalodon were designed to harvest secrets from within the CI/CD environment: cloud provider credentials, API keys, authentication tokens, and environment variables containing access to cloud infrastructure. Because these workflows executed within the repository’s own automation context, they had legitimate access to secrets that the repository had been granted including production cloud keys.

The harvested credentials were exfiltrated to attacker-controlled infrastructure. In repositories with broad cloud access, this gave attackers a direct foothold in production environments belonging to organisations that may not have known their repository had been compromised.

Why the Speed Matters

5,500 repositories in six hours represents an automation level that manual security response cannot match. By the time a development team noticed anomalous workflow execution and began investigating, the exfiltration had already occurred across thousands of targets simultaneously.

This is the same machine-speed dynamic that CERT-In flagged in its AI blueprint this week: attacks are now operating at a velocity that compresses the window between initial compromise and actionable damage to near-zero. In a supply chain attack targeting CI/CD secrets, the damage access to production cloud environments is immediate and persists beyond the initial attack window because the stolen credentials remain valid until they are rotated.

The Attack Surface Most Teams Are Ignoring

GitHub Actions workflows are code. They execute with the same privileges as the repository they belong to, and they often have access to secrets far more sensitive than the code itself production database credentials, cloud provider master keys, and signing certificates that enable code to pass security checks during deployment.

Security teams that review application code carefully but have not established equivalent scrutiny for GitHub Actions workflow files are operating with a significant blind spot. A single malicious or compromised workflow file can exfiltrate every secret the repository has been granted access to, in the time it takes the pipeline to run.

Immediate Actions for Development and Security Teams

• Audit all GitHub Actions workflows in your repositories immediately, particularly those added or modified in the last 30 days.
• Pin GitHub Actions to specific commit hashes rather than mutable tags this prevents action substitution attacks.
• Apply least privilege principles to the secrets granted to each repository and workflow.
• Enable GitHub’s secret scanning and push protection features if not already active.
• Review which repositories have access to production cloud credentials and revoke any that do not have a verified operational need.
• Implement workflow approval requirements for any pipeline that has access to production secrets.

For Indian enterprises, CI/CD compromises of this nature could constitute a reportable security incident under CERT-In Directions 2022 if the stolen credentials provide access to systems holding personal data.