Megalodon: Mass Repo Backdooring via CI Workflows

The Megalodon campaign injected malicious GitHub Actions workflows into 5,561 repositories within six hours, disguised as routine CI maintenance commits, the kind nobody actually reviews. The backdoors exfiltrate CI secrets, cloud credentials, SSH keys, and OIDC tokens to a C2 server, and reached npm when the legitimate Tiledesk maintainer unknowingly published from a backdoored repository. GitHub’s malware advisory lists six affected versions of @tiledesk/tiledesk-server between 2.18.6 and 2.18.12 and tells anyone who installed them to treat the machine as fully compromised and rotate every secret from a clean computer. Compromising the upstream repo instead of the package account neatly sidesteps everything the registry-side security controls were built to catch.