ghtier — GitHub permissions, tiers and attack paths

OrganizationMay 2026

Megalodon: mass backdooring of CI workflows

On 18 May 2026, in about six hours, throwaway accounts pushed 5,718 commits into 5,561 public repositories, straight to the default branch and without pull requests. The commits claimed to come from bots such as build-bot and ci-bot, but no real account was linked to those names. A mass variant added a workflow that ran on push and pull_request_target and sent secrets out. A targeted variant replaced existing workflows with one that only runs on workflow_dispatch, a dormant backdoor the attacker can fire later through the API. At least one project, Tiledesk, then published npm versions built from the poisoned source; the npm account itself was never touched. How the attacker got push access to so many repositories is not established in the primary write-ups.

Permissions abused

Push to the default branch without reviewworkflows: write (new and replaced workflows)

On the permission reference

T1Workflows: Write T2Contents: Write

Sources

Reported by: SafeDep, StepSecurity

How it unfolded

1
Push access is obtained (how is unknown)
The commits were pushed directly to default branches. A stolen token or deploy key is the likely explanation, but neither write-up confirms it.
2
Commits pose as CI bots
The author name was set to things like build-bot, auto-ci or pipeline-bot. Git lets anyone write any author name; without signed commits nothing tells them apart from a real bot.
3
A workflow steals secrets on the next run
The mass variant added a workflow triggered on push and pull_request_target that exfiltrated the repository's secrets.
4
A dormant workflow is left for later
The targeted variant replaced existing workflows with one that only runs on workflow_dispatch, so it does nothing until the attacker triggers it.
5
A package ships from the poisoned source
Tiledesk's maintainer published several npm versions from the backdoored repository before it was noticed.

Mitigations

Protect the default branch with a ruleset that requires a pull request — every commit went straight to the default branch
Require code owner review for .github/workflows — a new or replaced workflow can't land on its own
Require signed commits — forged bot author names stand out
Alert on new workflows and unexpected workflow_dispatch runs — the dormant variant only shows itself when fired
Restrict classic PATs and set a maximum token lifetime — limits what one stolen token can push to

Frameworks

CICD-SEC-1 CICD-SEC-4 CICD-SEC-6 CICD-SEC-10 NIST 5.1.2 NIST 5.1.4

Part of

One stolen credential, thousands of repositories

Contained. First seen May 2026. How the attacker got in is not confirmed. 5,718 commits to 5,561 repositories in about six hours (as of 21 May 2026, source). Mapping by ghtier, not yet reviewed. Threat landscape