Supply Chain Incident
Megalodon GitHub Actions repository workflow poisoning campaign
The Megalodon campaign inserted malicious GitHub Actions workflows into thousands of public repositories to harvest CI/CD secrets and cloud credentials through automated commit activity.
ConfidenceHigh
Evidence LevelResearcher
Attack StageSource Compromise
Source Artifact DivergenceNo
Attribution ConfidenceSuspected
Affected Packages
No structured records.
Affected Releases
No structured records.
Repositories
No structured records.
Organizations
No structured records.
Maintainers
No structured records.
Threat Actors
Campaigns
Build Systems
- GitHub Actions
Distribution Channels
- GitHub repositories
Compromised Accounts
- repository automation commit identities
Connected Entities
- GitHub ActionsBuild System
- GitHub repositoriesDistribution Channel
- Megalodon Supply-Chain Intrusion Campaign in GitHub and npmCampaign
- repository automation commit identitiesCompromised Account
- TeamPCPThreat Actor
Attribution Evidence
Cloud Security Alliance frames Megalodon as part of TeamPCP-linked May 2026 supply-chain activity; Threatpedia records this as suspected, not confirmed.
The Megalodon campaign node groups the large-scale GitHub Actions workflow poisoning activity acknowledged by StepSecurity and CISA.
References
- Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public RepositoriesStepSecurity · 2026-05-22
- Supply Chain Compromises Impact Nx Console and GitHub RepositoriesCybersecurity and Infrastructure Security Agency · 2026-05-28
- Megalodon: Mass CI/CD Pipeline Poisoning via GitHub ActionsCloud Security Alliance · 2026-05-24
- Over 5,500 GitHub Repositories Infected in 'Megalodon' Supply Chain AttackSecurityWeek · 2026-05-25