Megalodon campaign backdoors GitHub CI/CD at scale

SafeDep researchers have exposed a mass repository backdooring campaign called Megalodon, targeting GitHub Actions workflow configuration files across projects of any language or stack. Unlike last week's Shai-Hulud campaign, which focused on npm packages, Megalodon operates at the infrastructure layer, injecting malicious code directly into CI/CD pipeline definitions rather than published packages. The attack vector is significant because workflow files are often treated as configuration rather than executable code, meaning they receive less scrutiny during code review. Any project using GitHub Actions is a potential target, regardless of whether it publishes to a package registry. Essentially: (SafeDep, GitHub) are at the center of a widening supply chain threat where the build pipeline itself is the exploit surface. - Megalodon targets .github/workflows files directly, allowing attackers to execute arbitrary code during CI runs across any affected repository. - The campaign is distinct from package-level attacks, broadening exposure beyond npm, PyPI, or any single ecosystem. - Scope of affected repositories has not been fully quantified in public disclosure as of this reporting. The shift from poisoning packages to poisoning pipelines means the entire GitHub-hosted open source ecosystem is effectively in scope, not just the subset that publishes artifacts.