Megalodon chums the waters in 5.5K+ GitHub repo poisonings

A malware campaign named Megalodon pushed malicious commits into more than 5,500 GitHub repositories. If a repository owner merges the commit, the malware runs within the CI/CD pipeline and spreads further. The malware targets CI/CD credential theft by stealing AWS secret keys and Google Cloud access tokens, and by querying cloud metadata for instance role credentials. It also reads SSH private keys, Docker and Kubernetes configurations, Vault tokens, and Terraform credentials. It scans source code for many secret patterns and exfiltrates GitHub tokens, including cloud authentication secrets, plus Bitbucket tokens. The result enables attackers to impersonate developers’ cloud identities and access additional systems.

"A malware-spreading scumbag swimming through GitHub pushed malicious commits to more than 5,500 repositories on Monday as part of an automated campaign called Megalodon. Similar to the earlier TeamPCP attacks that poisoned about 3,800 GitHub repositories, this new campaign has so far infected 5,561 repos with CI/CD credential-stealing malware, according to SafeDep researchers, who uncovered the predatory commits and published a full list of the compromised repositories."

"If a repository owner merges the commit, the malware executes inside their CI/CD pipeline and propagates further, Ox Security lead researcher Moshe Siman Tov Bustan said in a Thursday blog post. Megalodon steals AWS secret keys and Google Cloud access tokens. It also queries AWS, Google Cloud Platform, and Azure metadata for instance role credentials, reads SSH private keys, Docker and Kubernetes configurations, Vault tokens, Terraform credentials, and scans source code for more than 30 secret regex patterns."

"Then it exfiltrates GitHub tokens, including secrets used to authenticate with cloud providers, thus allowing attackers to impersonate developers' cloud identities, along with Bitbucket tokens. In other words: consider ALL of your CI/CD variables pwned. "We've entered a new supply chain attack era, and TeamPCP compromising GitHub was only the beginning," Bustan told The Register."

"Plus, he added, hacking GitHub "compromises the security of every company with a private repository hosted on the platform." This new wave of supply chain attacks hitting developers' environments won't stop until "companies like npm and GitHub take serious action against the spread of malicious code on their servers," Bustan said. He noted npm's statement on X saying it "invalidated npm granular access tokens with write access that bypass 2FA""

Read at theregister