Edition 2026-Q4 · reviewed 11 October 2026 · next review 15 January 2027 · methodology

GitHub threat landscape

Attacks on GitHub in 2026 are faster and more automated than the frameworks written to describe them. Campaigns scan all of public GitHub for one weak workflow, push credential stealers into thousands of repositories in an afternoon, and spread through package registries with tokens taken from the last victim. This page follows those campaigns, maps every incident on ghtier to OWASP CI/CD and NIST SP 800-204D, and points at the controls that would have broken them.

Why access in GitHub is hard to keep track of

GitHub grants access in more ways than most teams keep track of. A person can get write access to a repository through the organization's base permission, a team, a direct invite, a custom role or by being an owner. A workflow gets it from its GITHUB_TOKEN, an App from its installation, and a laptop from a classic token someone created three years ago and never revoked.

Each of those speaks its own language. Classic tokens use scopes, fine-grained tokens and Apps use permissions, people get roles, machines use keys, and settings decide which of them is allowed at all. Pushing to the default branch can be allowed by any of them, and blocked by a ruleset that some of them can bypass.

The map keeps growing. New features such as coding agents, rulesets, custom properties and artifact attestations bring new permissions and settings, and the older ways of granting access stay for compatibility. ghtier reads GitHub's permission, role and scope data every week and records what changed. An attacker only needs one path through it, which is what the rest of this page is about.

23 policies, grants and outside systems (SSO, IP allow list, PAT policy, rulesets, cloud trust) sit across all five layers and decide which of them are allowed at all. The same access is described in 5 different vocabularies: scopes, permissions, roles, keys and settings.

The 190 permission levels by tier

T0 5
T1 28
T2 50
T3 107

An attacker needs one path through all of this. ghtier has mapped 11 ways in, 29 techniques and 14 escalations, seen in 31 real incidents. →

Counted from ghtier's own data at build time. GitHub's permission, role and scope tables are refreshed every week.

What attackers are doing now

The patterns behind the incidents of the last year. Draft for this edition; each trend links the incidents that show it and the checklist items that break it.

Emergingsince May 2026

The developer's workstation is the way in

A backdoored VS Code extension on one employee's machine led to the theft of about 3,800 of GitHub's own internal repositories, and GlassWorm's extensions took developers' GitHub tokens and used them to force-push malware into hundreds of repositories. Session-cookie theft and token-harvesting worms work the same way: whatever the developer's machine can reach, the attacker can reach. Short-lived tokens, an IP allow list and keeping sensitive work off the laptop limit what one compromised machine is worth.

CICD-SEC-6 CICD-SEC-8

Seen in

GitHub's internal repositories taken through a VS Code extensionUser
CircleCI session-cookie theftUser
Shai-Hulud self-propagating worm (1.0 & 2.0)Organization
Nx "s1ngularity"Organization
GlassWorm: editor extensions that steal GitHub tokens and force-pushUser

Broken by

Establishedsince February 2026

Pull request attacks are now automated

Abusing pull_request_target and workflow_run has been a known bug class for years. In 2026 it turned into a scanning operation. hackerbot-claw in February and prt-scan in March and April searched public GitHub for vulnerable workflows and opened malicious pull requests in bulk, and their payloads adapted to common hardening such as label gating. The attacker needs no access to the target repository, only a fork and a workflow that trusts it.

CICD-SEC-4 CICD-SEC-5

Seen in

"Pwn requests": pull_request_target & workflow_runOrganization
hackerbot-claw autonomous agent RCEOrganization
prt-scan: automated pull_request_target attacksOrganization
Ultralytics build cache poisoningOrganization

Broken by

Emergingsince September 2025

One stolen credential, thousands of repositories

GhostAction and Megalodon pushed credential-stealing workflows straight into repositories, dressed up as CI maintenance and committed under bot-like names. They work wherever a token can push to the default branch with no review in between. Megalodon reached more than five thousand repositories in about six hours, and GhostAction came back in 2026 at a larger scale than its first run.

CICD-SEC-1 CICD-SEC-6 CICD-SEC-10

Seen in

GhostActionOrganization
Megalodon: mass backdooring of CI workflowsOrganization
Dependabot impersonationUser

Broken by

Establishedsince September 2025

Package worms turn each victim into the next publisher

Shai-Hulud, its May 2026 successor and ChainDrop in August 2026 steal npm and GitHub tokens from developer machines and CI runners, then publish infected versions of the victim's own packages. Each new victim becomes a publisher for the next round. Shai-Hulud 2.0 also registered infected machines as self-hosted runners to keep its access. Publishing only from a workflow with a short-lived credential takes away the tokens a worm finds on laptops. It is not enough on its own. ChainDrop started from the keyv maintainer's GitHub account, pushed to main and let the projects' own trusted publishing workflows ship the malware with valid provenance. The publish workflow also needs a protected branch, protected tags and a reviewer.

CICD-SEC-3 CICD-SEC-6 CICD-SEC-9

Seen in

Shai-Hulud self-propagating worm (1.0 & 2.0)Organization
Nx "s1ngularity"Organization
ChainDrop: a hijacked maintainer account publishes through trusted publishingOrganization

Broken by

Emergingsince May 2025

AI agents hold tokens and read untrusted text

Coding agents and MCP servers act with a person's GitHub token while reading issues, pull requests and files that anyone can write. A prompt injection in one public issue becomes access to every repository the token reaches. Attackers use AI as well: hackerbot-claw and prt-scan automated discovery and payloads, and s1ngularity told victims' own AI command line tools to hunt for secrets on their machines.

CICD-SEC-2 CICD-SEC-5 CICD-SEC-8

Seen in

GitHub MCP / agentic token breadthApplication
hackerbot-claw autonomous agent RCEOrganization
prt-scan: automated pull_request_target attacksOrganization
Nx "s1ngularity"Organization

Broken by

Establishedsince March 2025

Version tags are a delivery channel

tj-actions in 2025, and TeamPCP's Trivy and KICS compromises in 2026, moved existing tags on widely used Actions to malicious commits. Every workflow that referenced the tag ran the payload on its next run, with nothing to review on the consumer's side. Pinning to a full commit SHA protects the consumer. Tag rulesets and immutable releases protect the maintainer.

CICD-SEC-3 CICD-SEC-9

Seen in

tj-actions/changed-files supply-chain compromise (CVE-2025-30066)Application
TeamPCP tag force-overwrite campaignOrganization

Broken by

Establishedsince January 2022

Self-hosted GHES is a patching race

GitHub Enterprise Server has had a steady run of serious flaws, from a SAML signature bypass to several ways for an administrator to reach root on the appliance. Each one is fixed in a patch release, and an instance is exposed until it is upgraded. For GHES operators the control is the upgrade cadence, plus keeping the set of site and organization administrators small.

CICD-SEC-7

Seen in

CVE-2024-4985: SAML auth bypassEnterprise
CVE-2025-11578: pre-receive hook symlink escapeEnterprise
CVE-2025-3509: pre-receive hook RCE via port reuseEnterprise
CVE-2026-3854: push-option metadata RCEEnterprise
CVE-2024-1374: Management Console template injectionEnterprise
CVE-2022-23732: Management Console path traversal / CSRF bypassEnterprise

Broken by

Limit the number of organization owners to the minimum needed

How attacks flow

Every incident on ghtier, from the way the attacker got in to what they went after, using the attack paths. Colour shows the plane the incident hit: control (settings, identity, policy), data (code, secrets, workflows, packages), both, or the GHES platform itself.

31 incidents, 81 pathsControlControl and dataDataPlatformWay in not confirmed

Each band is one or more incidents. An incident with two ways in or three objectives adds a band for each combination. Hover a band for the incidents in it.

Member with write access
- → Take over the GHES appliance1
Leaked token
- → Submit malicious code4
- → Point a release tag at a bad commit2
- → Steal CI secrets and tokens6
- → Poison the build or published package3
- → Read or expose private code2
- → Keep access2
Phished or hijacked account
- → Submit malicious code3
- → Delete code or cover tracks1
- → Point a release tag at a bad commit1
- → Steal CI secrets and tokens3
- → Poison the build or published package2
- → Read or expose private code3
- → Keep access2
Compromised GitHub App or OAuth integration
- → Submit malicious code1
- → Read or expose private code1
Untrusted input reaches a privileged workflow
- → Submit malicious code1
- → Delete code or cover tracks1
- → Steal CI secrets and tokens7
- → Poison the build or published package4
- → Read or expose private code1
Compromised Action or package
- → Submit malicious code2
- → Delete code or cover tracks1
- → Point a release tag at a bad commit3
- → Steal CI secrets and tokens3
- → Poison the build or published package3
- → Read or expose private code1
- → Keep access1
Compromised developer tool or extension
- → Submit malicious code1
- → Delete code or cover tracks1
- → Steal CI secrets and tokens2
- → Poison the build or published package2
- → Read or expose private code2
- → Keep access1
Prompt injection into an AI agent
- → Read or expose private code1
Vulnerability in GitHub Enterprise Server
- → Take over the GHES appliance6

Show as a table

Way in	Went after	Plane	Incidents
Member with write access	Take over the GHES appliance	Platform	CVE-2026-3854: push-option metadata RCE
Leaked token	Submit malicious code	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Leaked token	Submit malicious code	Data	Dependabot impersonation, GhostAction
Leaked token (not confirmed)	Submit malicious code	Data	Megalodon: mass backdooring of CI workflows
Leaked token	Point a release tag at a bad commit	Data	tj-actions/changed-files supply-chain compromise (CVE-2025-30066), TeamPCP tag force-overwrite campaign
Leaked token	Steal CI secrets and tokens	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Leaked token	Steal CI secrets and tokens	Data	Dependabot impersonation, tj-actions/changed-files supply-chain compromise (CVE-2025-30066), ArtiPACKED artifact token leakage, GhostAction
Leaked token (not confirmed)	Steal CI secrets and tokens	Data	Megalodon: mass backdooring of CI workflows
Leaked token	Poison the build or published package	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Leaked token	Poison the build or published package	Data	TeamPCP tag force-overwrite campaign
Leaked token (not confirmed)	Poison the build or published package	Data	Megalodon: mass backdooring of CI workflows
Leaked token	Read or expose private code	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Leaked token	Read or expose private code	Data	Mercedes-Benz source code exposure
Leaked token	Keep access	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Leaked token (not confirmed)	Keep access	Data	Megalodon: mass backdooring of CI workflows
Phished or hijacked account	Submit malicious code	Control	OAuth consent phishing at scale
Phished or hijacked account	Submit malicious code	Control and data	Salesloft Drift GitHub → AWS pivot
Phished or hijacked account (not confirmed)	Submit malicious code	Control and data	ChainDrop: a hijacked maintainer account publishes through trusted publishing
Phished or hijacked account (not confirmed)	Delete code or cover tracks	Control and data	ChainDrop: a hijacked maintainer account publishes through trusted publishing
Phished or hijacked account (not confirmed)	Point a release tag at a bad commit	Control and data	ChainDrop: a hijacked maintainer account publishes through trusted publishing
Phished or hijacked account	Steal CI secrets and tokens	Control and data	CircleCI session-cookie theft, Salesloft Drift GitHub → AWS pivot
Phished or hijacked account (not confirmed)	Steal CI secrets and tokens	Control and data	ChainDrop: a hijacked maintainer account publishes through trusted publishing
Phished or hijacked account	Poison the build or published package	Control and data	Toptal repo-visibility flip and wiper
Phished or hijacked account (not confirmed)	Poison the build or published package	Control and data	ChainDrop: a hijacked maintainer account publishes through trusted publishing
Phished or hijacked account	Read or expose private code	Control	OAuth consent phishing at scale
Phished or hijacked account	Read or expose private code	Control and data	Toptal repo-visibility flip and wiper, Salesloft Drift GitHub → AWS pivot
Phished or hijacked account	Keep access	Control	OAuth consent phishing at scale
Phished or hijacked account	Keep access	Control and data	Salesloft Drift GitHub → AWS pivot
Compromised GitHub App or OAuth integration	Submit malicious code	Data	GitHub App installation token abuse
Compromised GitHub App or OAuth integration	Read or expose private code	Control and data	Heroku / Travis CI OAuth token theft
Untrusted input reaches a privileged workflow	Submit malicious code	Data	hackerbot-claw autonomous agent RCE
Untrusted input reaches a privileged workflow	Delete code or cover tracks	Control and data	Nx "s1ngularity"
Untrusted input reaches a privileged workflow	Steal CI secrets and tokens	Control and data	Nx "s1ngularity"
Untrusted input reaches a privileged workflow	Steal CI secrets and tokens	Data	"Pwn requests": pull_request_target & workflow_run, Ultralytics build cache poisoning, Self-hosted runner takeovers (PyTorch and others), hackerbot-claw autonomous agent RCE, Actions cache poisoning (Angular, TanStack), prt-scan: automated pull_request_target attacks
Untrusted input reaches a privileged workflow	Poison the build or published package	Control and data	Nx "s1ngularity"
Untrusted input reaches a privileged workflow	Poison the build or published package	Data	Ultralytics build cache poisoning, Self-hosted runner takeovers (PyTorch and others), Actions cache poisoning (Angular, TanStack)
Untrusted input reaches a privileged workflow	Read or expose private code	Control and data	Nx "s1ngularity"
Compromised Action or package	Submit malicious code	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Compromised Action or package (not confirmed)	Submit malicious code	Control and data	ChainDrop: a hijacked maintainer account publishes through trusted publishing
Compromised Action or package (not confirmed)	Delete code or cover tracks	Control and data	ChainDrop: a hijacked maintainer account publishes through trusted publishing
Compromised Action or package (not confirmed)	Point a release tag at a bad commit	Control and data	ChainDrop: a hijacked maintainer account publishes through trusted publishing
Compromised Action or package	Point a release tag at a bad commit	Data	tj-actions/changed-files supply-chain compromise (CVE-2025-30066), TeamPCP tag force-overwrite campaign
Compromised Action or package	Steal CI secrets and tokens	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Compromised Action or package (not confirmed)	Steal CI secrets and tokens	Control and data	ChainDrop: a hijacked maintainer account publishes through trusted publishing
Compromised Action or package	Steal CI secrets and tokens	Data	tj-actions/changed-files supply-chain compromise (CVE-2025-30066)
Compromised Action or package	Poison the build or published package	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Compromised Action or package (not confirmed)	Poison the build or published package	Control and data	ChainDrop: a hijacked maintainer account publishes through trusted publishing
Compromised Action or package	Poison the build or published package	Data	TeamPCP tag force-overwrite campaign
Compromised Action or package	Read or expose private code	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Compromised Action or package	Keep access	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Compromised developer tool or extension	Submit malicious code	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Compromised developer tool or extension	Delete code or cover tracks	Data	GlassWorm: editor extensions that steal GitHub tokens and force-push
Compromised developer tool or extension	Steal CI secrets and tokens	Control and data	CircleCI session-cookie theft, Shai-Hulud self-propagating worm (1.0 & 2.0)
Compromised developer tool or extension	Poison the build or published package	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Compromised developer tool or extension	Poison the build or published package	Data	GlassWorm: editor extensions that steal GitHub tokens and force-push
Compromised developer tool or extension	Read or expose private code	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Compromised developer tool or extension	Read or expose private code	Data	GitHub's internal repositories taken through a VS Code extension
Compromised developer tool or extension	Keep access	Control and data	Shai-Hulud self-propagating worm (1.0 & 2.0)
Prompt injection into an AI agent	Read or expose private code	Data	GitHub MCP / agentic token breadth
Vulnerability in GitHub Enterprise Server	Take over the GHES appliance	Platform	CVE-2024-4985: SAML auth bypass, CVE-2025-11578: pre-receive hook symlink escape, CVE-2025-3509: pre-receive hook RCE via port reuse, CVE-2026-3854: push-option metadata RCE, CVE-2024-1374: Management Console template injection, CVE-2022-23732: Management Console path traversal / CSRF bypass

OWASP CI/CD risks over time

Incidents per OWASP CI/CD risk, by the year they were first seen. One incident can count under several risks. The last column counts the 12 months up to 11 October 2026, from 11 October 2025. See also the NIST SP 800-204D crosswalk.

Incidents per OWASP CI/CD risk and year first seen
Risk	2021	2022	2023	2024	2025	2026	Last 12 months
1 Insufficient Flow Control Mechanisms	0	0	1	0	2	3	4
2 Inadequate Identity and Access Management	0	1	0	1	4	1	1
3 Dependency Chain Abuse	0	0	0	0	3	2	2
4 Poisoned Pipeline Execution (PPE)	1	0	1	1	1	4	4
5 Insufficient PBAC (Pipeline-Based Access Controls)	1	1	1	0	1	2	2
6 Insufficient Credential Hygiene	0	2	1	3	6	3	4
7 Insecure System Configuration	0	1	1	2	2	1	1
8 Ungoverned Usage of 3rd Party Services	0	3	0	0	3	0	0
9 Improper Artifact Integrity Validation	0	0	0	1	4	3	3
10 Insufficient Logging and Visibility	0	0	1	0	1	1	1

Where the frameworks are silent

What the 2026 campaigns rely on that OWASP CI/CD (2022) and NIST SP 800-204D (2024) cover only in part, or not at all.

AI agents and MCP servers

The OWASP CI/CD list dates from 2022, before coding agents, and NIST SP 800-204D (February 2024) does not cover them either. Neither says anything about an agent that holds a token and reads text anyone can write.

Closest coverage: OWASP Top 10 for Agentic Applications for 2026 (GenAI Security Project)

Developer machines and IDE extensions

OWASP has no category for the developer's own machine. NIST names securing CI/CD clients as one step of its implementation strategy (section 5.3) but sets no requirements for it. Extensions, local tools and the tokens stored next to them fall between the two.

Worms that publish with stolen tokens

NIST's supply chain model has propagation as a stage, and CICD-SEC-3 covers dependency chain abuse. Neither gives controls for breaking the loop of stolen token, malicious publish, next victim: no long-lived registry tokens, publishing only from a reviewed workflow, and a cooldown before new versions are installed. Trusted publishing helps, but a hijacked maintainer account can still trigger it, as ChainDrop did.

Speed and scale

The frameworks treat each misconfiguration on its own: does the control exist or not. Campaigns in 2026 scan all of public GitHub for one misconfiguration and exploit it within hours, so how fast a fix is rolled out across every repository matters as much as whether the control exists.

Incidents that fit the OWASP list only in part or not at all: CircleCI session-cookie theft (partial), GitHub's internal repositories taken through a VS Code extension (no fit), GlassWorm: editor extensions that steal GitHub tokens and force-push (partial), GitHub MCP / agentic token breadth (partial), Nx "s1ngularity" (partial), Shai-Hulud self-propagating worm (1.0 & 2.0) (partial).

Controls that break the most current campaigns

Checklist items ranked by how many incidents first seen in the last 12 months they would have broken at least one step of, then by all incidents. A step counts when the item is listed as a fix for an attack path technique used in the incident. Breaking one step does not mean the incident would have been prevented.

1
Adopt artifact attestations for build provenance on published binaries/images
Would have broken a step of Actions cache poisoning (Angular, TanStack), ChainDrop: a hijacked maintainer account publishes through trusted publishing, Megalodon: mass backdooring of CI workflows, TeamPCP tag force-overwrite campaign, GlassWorm: editor extensions that steal GitHub tokens and force-push
5 recent · 8 all time
2
Cloud credentials migrated from static keys to OIDC federation, scoped to repo + branch
Would have broken a step of ChainDrop: a hijacked maintainer account publishes through trusted publishing, Megalodon: mass backdooring of CI workflows, TeamPCP tag force-overwrite campaign, GlassWorm: editor extensions that steal GitHub tokens and force-push
4 recent · 9 all time
3
Write and rehearse a credential-rotation runbook before you need it
Would have broken a step of ChainDrop: a hijacked maintainer account publishes through trusted publishing, Megalodon: mass backdooring of CI workflows, TeamPCP tag force-overwrite campaign, GlassWorm: editor extensions that steal GitHub tokens and force-push
4 recent · 7 all time
4
Put production secrets in environments with required reviewers
Would have broken a step of ChainDrop: a hijacked maintainer account publishes through trusted publishing, Megalodon: mass backdooring of CI workflows, TeamPCP tag force-overwrite campaign, GlassWorm: editor extensions that steal GitHub tokens and force-push
4 recent · 6 all time
5
Publish packages with trusted publishing (OIDC) instead of long-lived registry tokens
Would have broken a step of ChainDrop: a hijacked maintainer account publishes through trusted publishing, Megalodon: mass backdooring of CI workflows, TeamPCP tag force-overwrite campaign, GlassWorm: editor extensions that steal GitHub tokens and force-push
4 recent · 6 all time
6
Rulesets applied: push restriction, tag protection, sensitive file-path protection
Would have broken a step of ChainDrop: a hijacked maintainer account publishes through trusted publishing, Megalodon: mass backdooring of CI workflows, TeamPCP tag force-overwrite campaign
3 recent · 10 all time
7
Set the default GITHUB_TOKEN permission to read-only at the org level
Would have broken a step of Actions cache poisoning (Angular, TanStack), hackerbot-claw autonomous agent RCE, prt-scan: automated pull_request_target attacks
3 recent · 9 all time
8
Branch protection on default/release branches: required reviews + required status checks
Would have broken a step of ChainDrop: a hijacked maintainer account publishes through trusted publishing, hackerbot-claw autonomous agent RCE, Megalodon: mass backdooring of CI workflows
3 recent · 8 all time
9
Audit every use of pull_request_target and remove or restructure risky ones
Would have broken a step of Actions cache poisoning (Angular, TanStack), hackerbot-claw autonomous agent RCE, prt-scan: automated pull_request_target attacks
3 recent · 6 all time
10
Enable audit logging and export it to a SIEM for retention and detection
Would have broken a step of ChainDrop: a hijacked maintainer account publishes through trusted publishing, Megalodon: mass backdooring of CI workflows, GlassWorm: editor extensions that steal GitHub tokens and force-push
3 recent · 6 all time

Timeline

Every incident by the date it was first seen. Ongoing campaigns run to the review date.

2021

1 April 2021"Pwn requests": pull_request_target & workflow_run Organization Untrusted input reaches a privileged workflow · ongoing, as of 11 October 2026

2022

1 January 2022GitHub App installation token abuse Application Compromised GitHub App or OAuth integration · ongoing, as of 11 October 2026
1 January 2022CVE-2022-23732: Management Console path traversal / CSRF bypass Enterprise Vulnerability in GitHub Enterprise Server
1 April 2022Heroku / Travis CI OAuth token theft Application Compromised GitHub App or OAuth integration
1 December 2022CircleCI session-cookie theft User Phished or hijacked account, Compromised developer tool or extension

2023

1 January 2023Self-hosted runner takeovers (PyTorch and others) Organization Untrusted input reaches a privileged workflow · ongoing, as of 11 October 2026
1 July 2023Dependabot impersonation User Leaked token

2024

1 January 2024Mercedes-Benz source code exposure User Leaked token
1 February 2024CVE-2024-1374: Management Console template injection Enterprise Vulnerability in GitHub Enterprise Server
1 May 2024CVE-2024-4985: SAML auth bypass Enterprise Vulnerability in GitHub Enterprise Server
1 August 2024ArtiPACKED artifact token leakage Application Leaked token · ongoing, as of 11 October 2026
1 December 2024Ultralytics build cache poisoning Organization Untrusted input reaches a privileged workflow

2025

1 January 2025OAuth consent phishing at scale User Phished or hijacked account · ongoing, as of 11 October 2026
1 March 2025tj-actions/changed-files supply-chain compromise (CVE-2025-30066) Application Leaked token, Compromised Action or package
1 March 2025Salesloft Drift GitHub → AWS pivot Organization Phished or hijacked account
1 April 2025CVE-2025-3509: pre-receive hook RCE via port reuse Enterprise Vulnerability in GitHub Enterprise Server
1 May 2025GitHub MCP / agentic token breadth Application Prompt injection into an AI agent · ongoing, as of 11 October 2026
1 July 2025Toptal repo-visibility flip and wiper Organization Phished or hijacked account
1 August 2025Nx "s1ngularity" Organization Untrusted input reaches a privileged workflow
1 September 2025GhostAction Organization Leaked token · ongoing, as of 9 October 2026
1 September 2025Shai-Hulud self-propagating worm (1.0 & 2.0) Organization Leaked token, Compromised Action or package, Compromised developer tool or extension
1 October 2025CVE-2025-11578: pre-receive hook symlink escape Enterprise Vulnerability in GitHub Enterprise Server
17 October 2025GlassWorm: editor extensions that steal GitHub tokens and force-push User Compromised developer tool or extension · ongoing, as of 13 March 2026

2026

1 February 2026hackerbot-claw autonomous agent RCE Organization Untrusted input reaches a privileged workflow
1 March 2026CVE-2026-3854: push-option metadata RCE Enterprise Member with write access, Vulnerability in GitHub Enterprise Server
1 March 2026TeamPCP tag force-overwrite campaign Organization Leaked token, Compromised Action or package
11 March 2026prt-scan: automated pull_request_target attacks Organization Untrusted input reaches a privileged workflow
11 May 2026Actions cache poisoning (Angular, TanStack) Organization Untrusted input reaches a privileged workflow · ongoing, as of 11 October 2026
18 May 2026Megalodon: mass backdooring of CI workflows Organization Leaked token
18 May 2026GitHub's internal repositories taken through a VS Code extension User Compromised developer tool or extension
4 August 2026ChainDrop: a hijacked maintainer account publishes through trusted publishing Organization Phished or hijacked account, Compromised Action or package

Sources

Incident write-ups (88)

Surprise: When Dependabot Contributes Malicious Code checkmarx.com, for Dependabot impersonation
Mercedes-Benz source code at risk: GitHub token mishap redhuntlabs.com, for Mercedes-Benz source code exposure
How a mistakenly published password exposed Mercedes-Benz source code techcrunch.com, for Mercedes-Benz source code exposure
A mishandled GitHub token exposed Mercedes-Benz source code bleepingcomputer.com, for Mercedes-Benz source code exposure
Leaked GitHub token exposed Mercedes source code securityweek.com, for Mercedes-Benz source code exposure
Fake 'Security Alert' issues use OAuth app to hijack accounts bleepingcomputer.com, for OAuth consent phishing at scale
Device code phishing explained: how attackers abuse OAuth across SaaS appomni.com, for OAuth consent phishing at scale
CircleCI: rotating secrets for the January 4th incident support.circleci.com, for CircleCI session-cookie theft
Investigating unauthorized access to GitHub's internal repositories github.blog, for GitHub's internal repositories taken through a VS Code extension
GitHub breached through a VS Code extension aikido.dev, for GitHub's internal repositories taken through a VS Code extension
5 supply chain attacks in 48 hours stepsecurity.io, for GitHub's internal repositories taken through a VS Code extension
Glassworm returns: invisible Unicode malware found in 150+ GitHub repositories aikido.dev, for GlassWorm: editor extensions that steal GitHub tokens and force-push
ForceMemo: hundreds of GitHub Python repos compromised via account takeover and force-push stepsecurity.io, for GlassWorm: editor extensions that steal GitHub tokens and force-push
GlassWorm attack uses stolen GitHub tokens to force-push malware into Python repos thehackernews.com, for GlassWorm: editor extensions that steal GitHub tokens and force-push
GitHub security alert: stolen OAuth user tokens github.blog, for Heroku / Travis CI OAuth token theft
GitHub Actions supply chain attack: Coinbase to tj-actions unit42.paloaltonetworks.com, for tj-actions/changed-files supply-chain compromise (CVE-2025-30066)
CISA alert: tj-actions/changed-files and reviewdog/action-setup cisa.gov, for tj-actions/changed-files supply-chain compromise (CVE-2025-30066)
GHSA-mrrh-fwg8-r2c3 (CVE-2025-30066) github.com, for tj-actions/changed-files supply-chain compromise (CVE-2025-30066)
tj-actions/changed-files supply chain attack (Wiz) wiz.io, for tj-actions/changed-files supply-chain compromise (CVE-2025-30066)
ArtiPACKED: hacking giants through a race condition in Actions artifacts unit42.paloaltonetworks.com, for ArtiPACKED artifact token leakage
GitHub Actions artifacts found leaking auth tokens in popular projects bleepingcomputer.com, for ArtiPACKED artifact token leakage
GitHub Actions security: a guide to common risks orca.security, for ArtiPACKED artifact token leakage
GitHub Actions hardening orca.security, for ArtiPACKED artifact token leakage
GitHub MCP exploited: accessing private repositories via MCP invariantlabs.ai, for GitHub MCP / agentic token breadth
github-mcp-server issue #844: token scope reproduction github.com, for GitHub MCP / agentic token breadth
Public GitHub issue could trick agentic workflows into leaking private repo data thehackernews.com, for GitHub MCP / agentic token breadth
MCP horror stories: the GitHub prompt injection data heist docker.com, for GitHub MCP / agentic token breadth
AI GitHub agents: how one issue leaked private repos upguard.com, for GitHub MCP / agentic token breadth
What is GitHub App token abuse? securelayer7.net, for GitHub App installation token abuse
HackerOne #1732595: scoped user-to-server token escalates to org admin/owner hackerone.com, for GitHub App installation token abuse
The case for GitHub Actions security after recent supply chain attacks securitylabs.datadoghq.com, for "Pwn requests": pull_request_target & workflow_run
Vulnerable GitHub Actions workflows: privilege escalation legitsecurity.com, for "Pwn requests": pull_request_target & workflow_run
Actions pull_request_target and environment branch protections changes github.blog, for "Pwn requests": pull_request_target & workflow_run
Keeping your GitHub Actions and workflows secure: preventing pwn requests securitylab.github.com, for "Pwn requests": pull_request_target & workflow_run
zizmor would have caught the Ultralytics workflow vulnerability blog.yossarian.net, for Ultralytics build cache poisoning
Ultralytics AI pwn request supply chain attack snyk.io, for Ultralytics build cache poisoning
The Ultralytics supply chain attack: how it happened, how to prevent legitsecurity.com, for Ultralytics build cache poisoning
Ultralytics AI library hacked via GitHub for cryptomining wiz.io, for Ultralytics build cache poisoning
The Ultralytics supply chain attack: connecting the dots blog.gitguardian.com, for Ultralytics build cache poisoning
s1ngularity: what happened, how we responded, what we learned nx.dev, for Nx "s1ngularity"
Learnings from recent npm compromises securitylabs.datadoghq.com, for Nx "s1ngularity"
OIDC trust chain abuse: cloud takeover labs.cloudsecurityalliance.org, for Nx "s1ngularity"
One supply chain attack to rule them all adnanthekhan.com, for Self-hosted runner takeovers (PyTorch and others)
TensorFlow supply chain compromise via self-hosted runner attack praetorian.com, for Self-hosted runner takeovers (PyTorch and others)
PyTorch supply chain compromise stepsecurity.io, for Self-hosted runner takeovers (PyTorch and others)
GitHub, PyTorch and more orgs vulnerable to self-hosted runner attacks legitsecurity.com, for Self-hosted runner takeovers (PyTorch and others)
The GhostAction campaign: 3,325 secrets stolen blog.gitguardian.com, for GhostAction
GhostAction returns: GitHub Actions supply chain attack blog.gitguardian.com, for GhostAction
GhostAction: cloud credentials targeted across tens of thousands of repositories socket.dev, for GhostAction
GhostAction returns stepsecurity.io, for GhostAction
Toptal's GitHub organization hijacked socket.dev, for Toptal repo-visibility flip and wiper
Hackers breach Toptal GitHub account, publish malicious npm packages bleepingcomputer.com, for Toptal repo-visibility flip and wiper
Anatomy of the Salesloft breach permiso.io, for Salesloft Drift GitHub → AWS pivot
GitHub account compromise led to Salesloft Drift breach thehackernews.com, for Salesloft Drift GitHub → AWS pivot
Inside Shai-Hulud's maw: how the npm worm exploits and propagates checkmarx.com, for Shai-Hulud self-propagating worm (1.0 & 2.0)
Shai-Hulud: self-replicating worm compromises 500+ npm packages stepsecurity.io, for Shai-Hulud self-propagating worm (1.0 & 2.0)
Shai-Hulud 2.0: host registered as SHA1HULUD runner securitylabs.datadoghq.com, for Shai-Hulud self-propagating worm (1.0 & 2.0)
Shai-Hulud npm supply chain attack unit42.paloaltonetworks.com, for Shai-Hulud self-propagating worm (1.0 & 2.0)
npm supply chain attack: GitHub API exploitation trendmicro.com, for Shai-Hulud self-propagating worm (1.0 & 2.0)
Hackers have compromised dozens of popular open source packages in an ongoing supply chain attack techcrunch.com, for Shai-Hulud self-propagating worm (1.0 & 2.0)
hackerbot-claw: AI-powered bot exploiting GitHub Actions stepsecurity.io, for hackerbot-claw autonomous agent RCE
HackerBot-Claw campaign timeline orca.security, for hackerbot-claw autonomous agent RCE
CVE-2026-33634 (Trivy, trivy-action and setup-trivy) nvd.nist.gov, for TeamPCP tag force-overwrite campaign
LiteLLM security update, March 2026 docs.litellm.ai, for TeamPCP tag force-overwrite campaign
Detecting, investigating, defending against Trivy supply chain compromise microsoft.com, for TeamPCP tag force-overwrite campaign
TeamPCP: seven waves of credential chaining trendmicro.com, for TeamPCP tag force-overwrite campaign
TeamPCP isn't done endorlabs.com, for TeamPCP tag force-overwrite campaign
KICS GitHub Action compromised wiz.io, for TeamPCP tag force-overwrite campaign
TeamPCP campaign overview arcticwolf.com, for TeamPCP tag force-overwrite campaign
TanStack npm supply chain compromise postmortem tanstack.com, for Actions cache poisoning (Angular, TanStack)
Cache poisoning through pull_request_target: the TanStack incident safedep.io, for Actions cache poisoning (Angular, TanStack)
The cache that bites back: GitHub Actions cache poisoning attacks hivesecurity.gitlab.io, for Actions cache poisoning (Angular, TanStack)
Six accounts, one actor: inside the prt-scan supply chain campaign wiz.io, for prt-scan: automated pull_request_target attacks
prt-scan: GitHub Actions exfiltration campaign safedep.io, for prt-scan: automated pull_request_target attacks
CSA research note: GitHub Actions prt-scan supply chain campaign labs.cloudsecurityalliance.org, for prt-scan: automated pull_request_target attacks
AI-assisted supply chain attack targets GitHub darkreading.com, for prt-scan: automated pull_request_target attacks
Megalodon: mass GitHub repo backdooring via CI workflows safedep.io, for Megalodon: mass backdooring of CI workflows
Megalodon: mass GitHub Actions secret exfiltration across 5,500 public repositories stepsecurity.io, for Megalodon: mass backdooring of CI workflows
ChainDrop npm worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 stepsecurity.io, for ChainDrop: a hijacked maintainer account publishes through trusted publishing
ChainDrop: the Keyv and Cacheable npm supply chain attack insights.integrity360.com, for ChainDrop: a hijacked maintainer account publishes through trusted publishing
GHSA-5pw9-f9r4-mv2r: CVE-2024-4985, SAML forge to site admin github.com, for CVE-2024-4985: SAML auth bypass
GitHub fixes maximum severity GHES auth bypass helpnetsecurity.com, for CVE-2024-4985: SAML auth bypass
CVE-2025-11578: enterprise admin to root via pre-receive symlink escape github.com, for CVE-2025-11578: pre-receive hook symlink escape
GHSA-g3x6-r9w9-mcxx: CVE-2025-3509, pre-receive hook RCE github.com, for CVE-2025-3509: pre-receive hook RCE via port reuse
GHSA-64fw-jx9p-5j24: CVE-2026-3854, push option injection to RCE github.com, for CVE-2026-3854: push-option metadata RCE
GHES vulnerability: find impacted assets runzero.com, for CVE-2026-3854: push-option metadata RCE
HackerOne #2332623: editor to root SSH via nomad template injection (CVE-2024-1374) hackerone.com, for CVE-2024-1374: Management Console template injection
CVE-2022-23732: Management Console path traversal, CSRF bypass github.com, for CVE-2022-23732: Management Console path traversal / CSRF bypass

Methodology

An incident is a public, sourced case of GitHub access being abused: a named campaign, a vulnerability class with real victims, or a GitHub Enterprise Server flaw. All 31 are on the incidents page.
Each incident is tagged with its way in and what the attacker went after (from the attack paths), the OWASP CI/CD risks and NIST SP 800-204D sections it touches, the plane it hit, and the date it was first seen. The counts on this page are computed from those tags when the site is built.
The framework mappings are ghtier's own reading, not OWASP's or NIST's. They are marked for review until confirmed. Trends and gaps are editorial.
Time windows count back from the review date (11 October 2026), not from today, so the page does not change between reviews. Where only a month is known, the first of the month is used.
The page is reviewed every quarter: new incidents are added, ongoing ones updated, and trends with no incident in the window retired.

GitHub threat landscape

Why access in GitHub is hard to keep track of

What attackers are doing now

The developer's workstation is the way in

Seen in

Broken by

Pull request attacks are now automated

Seen in

Broken by

One stolen credential, thousands of repositories

Seen in

Broken by

Package worms turn each victim into the next publisher

Seen in

Broken by

AI agents hold tokens and read untrusted text

Seen in

Broken by

Version tags are a delivery channel

Seen in

Broken by

Self-hosted GHES is a patching race

Seen in

Broken by

How attacks flow

OWASP CI/CD risks over time

Where the frameworks are silent

AI agents and MCP servers

Developer machines and IDE extensions

Worms that publish with stolen tokens

Speed and scale

Controls that break the most current campaigns

Timeline

2021

2022

2023

2024

2025

2026

Sources

Frameworks

Annual reports

GitHub's own guidance

Methodology