GitHub: 5,561 GitHub Repositories Hit by Megalodon Supply Chain Attack in Six Hours

Massive "Megalodon" Attack Targets 5,500+ GitHub Repositories in Automated Campaign

On May 18, 2026, cybersecurity firm SafeDep uncovered a large-scale automated attack dubbed "Megalodon", which compromised 5,561 GitHub repositories by pushing 5,718 malicious code updates within a six-hour window. The campaign, detected using SafeDep’s Malysis scanning tool, embedded hidden backdoors in otherwise legitimate files, evading initial detection.

Attackers leveraged fake GitHub accounts with randomized eight-character names and disguised their activity by mimicking official automated services, using sender identities like build-bot@, auto-ci@, and pipeline-bot@. The operation coincided with a separate breach by TeamPCP, which compromised 3,800 repositories via a malicious VS Code extension, highlighting a broader trend of targeting developers.

Two Stealthy Attack Methods

The Megalodon campaign employed two primary techniques:

1. SysDiag – Added a malicious .github/workflows/ci.yml file that triggered a data-stealing script whenever a developer updated their project.
2. Optimize-Build – Replaced existing system files with dormant backdoors, activated later via the GitHub API to avoid detection.

Major Victim: Tiledesk

The attack heavily impacted Tiledesk, a live chat and chatbot service. Hackers compromised nine of its GitHub repositories, leading the developer to unknowingly publish seven infected versions of its @tiledesk/tiledesk-server package (v2.18.6–2.18.12) to npm between May 19–21, 2026.

Data Theft & Cloud Credential Harvesting

Once executed, the malware ran an 111-line background script, exfiltrating sensitive data to a command-and-control (C2) server at 216.126.225.129:8443. The stolen information included:

• Cloud credentials (AWS, Google Cloud, Microsoft Azure)
• System logs, code files, and 30 types of private keys
• GitHub Actions tokens, allowing attackers to impersonate legitimate workflows and gain unauthorized access to linked cloud environments.

The incident underscores the growing sophistication of supply-chain attacks targeting open-source ecosystems, with developers and organizations facing heightened risks from automated, large-scale breaches.

Source: https://hackread.com/github-repositories-megalodon-supply-chain-attack/

GitHub cybersecurity rating report: https://www.rankiteo.com/company/github

"id": "GIT1779459975",
"linkid": "github",
"type": "Cyber Attack",
"date": "5/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Software/Technology',
                        'name': 'Tiledesk',
                        'type': 'Live Chat and Chatbot Service'},
                       {'industry': 'Software Development',
                        'name': 'GitHub Repositories (General)',
                        'size': '5,561 repositories',
                        'type': 'Open-Source Projects'}],
 'attack_vector': ['Malicious Code Updates',
                   'Fake GitHub Accounts',
                   'GitHub API Exploitation'],
 'data_breach': {'data_exfiltration': 'Yes (to C2 server at '
                                      '216.126.225.129:8443)',
                 'sensitivity_of_data': 'High (credentials, private keys)',
                 'type_of_data_compromised': ['Cloud credentials',
                                              'Private keys',
                                              'System logs',
                                              'Code files',
                                              'GitHub Actions tokens']},
 'date_detected': '2026-05-18',
 'date_publicly_disclosed': '2026-05-18',
 'description': "A large-scale automated attack dubbed 'Megalodon' compromised "
                '5,561 GitHub repositories by pushing 5,718 malicious code '
                'updates within a six-hour window. The campaign embedded '
                'hidden backdoors in legitimate files, evading initial '
                'detection. Attackers used fake GitHub accounts and disguised '
                'their activity by mimicking official automated services. The '
                'attack coincided with a separate breach by TeamPCP, which '
                'compromised 3,800 repositories via a malicious VS Code '
                'extension.',
 'impact': {'brand_reputation_impact': 'High (e.g., Tiledesk unknowingly '
                                       'published infected packages)',
            'data_compromised': ['Cloud credentials (AWS, Google Cloud, '
                                 'Microsoft Azure)',
                                 'System logs',
                                 'Code files',
                                 '30 types of private keys',
                                 'GitHub Actions tokens'],
            'identity_theft_risk': 'High (private keys and credentials '
                                   'exposed)',
            'operational_impact': 'Unauthorized access to linked cloud '
                                  'environments',
            'systems_affected': ['GitHub Repositories', 'npm Packages']},
 'initial_access_broker': {'backdoors_established': 'Yes (SysDiag and '
                                                    'Optimize-Build '
                                                    'techniques)',
                           'entry_point': 'Fake GitHub accounts and malicious '
                                          'code updates',
                           'high_value_targets': ['Tiledesk',
                                                  'GitHub repositories with '
                                                  'cloud credentials']},
 'lessons_learned': 'The incident underscores the growing sophistication of '
                    'supply-chain attacks targeting open-source ecosystems, '
                    'with developers and organizations facing heightened risks '
                    'from automated, large-scale breaches.',
 'motivation': ['Data Theft',
                'Cloud Credential Harvesting',
                'Supply Chain Compromise'],
 'post_incident_analysis': {'root_causes': ['Lack of GitHub workflow security',
                                            'Dormant backdoor exploitation',
                                            'Automated attack tools']},
 'references': [{'source': 'SafeDep'}],
 'response': {'third_party_assistance': 'SafeDep (Malysis scanning tool)'},
 'threat_actor': ['Unknown (Megalodon Campaign)', 'TeamPCP'],
 'title': 'Megalodon Attack Targets 5,500+ GitHub Repositories',
 'type': 'Supply Chain Attack',
 'vulnerability_exploited': ['GitHub Workflows Misconfiguration',
                             'Dormant Backdoors']}