Over 5,500 GitHub Repositories Hit by 'Megalodon' Supply Chain Attack

Massive GitHub attack infects 5,500+ repositories with malware, stealing sensitive data via rogue workflows in a supply chain breach.

By Content Team

May 25, 2026

ON THIS PAGE

More than 5,500 GitHub repositories — 5,561, by SafeDep's count — were infected with malware on May 18, 2026, in a supply chain attack called Megalodon. Attackers pushed 5,718 malicious commits across a six-hour window using two email addresses, injecting rogue GitHub Actions workflows designed to steal credentials, AWS keys, SSH private keys, API tokens, and dozens of other secrets from CI environments.

They got in with stolen personal access tokens and deploy keys, pushing straight to master with no pull request. Hudson Rock matched more than a third of the usernames behind the affected repositories to machines infected by infostealer malware. The workflows sent everything to 216.126.225[.]129.

The attack surfaced when poisoned Tiledesk npm versions 2.18.6 through 2.18.12 were published May 19–21. The maintainer unknowingly published from a poisoned source — the attacker never touched the npm account, only the GitHub repo. A dormant backdoor was also planted, triggerable later via the GitHub API using stolen tokens. Rotate any token that can reach your repositories, and check for workflow files nobody on your team wrote.

Source: SecurityWeek

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?