Megalodon:通过CI工作流大规模后门GitHub仓库
摘要
一项安全研究揭示了一种名为Megalodon的技术,通过利用CI工作流大规模后门GitHub仓库。
<p><a href="https://lobste.rs/s/k2ifb5/megalodon_mass_github_repo_backdooring">评论</a></p>
查看缓存全文
缓存时间: 2026/05/22 10:32
# Megalodon: 通过CI工作流大规模后门植入GitHub仓库
来源:https://safedep.io/megalodon-mass-github-repo-backdooring-ci-workflows/
1batnano/test\-action\-523509a94620000171d4780apipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T15:26:51\.000Z构建: 提升CI性能2arj1211/sql\-practice00035298ed2cbuild\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T15:41:42\.000Z修复: 修正构建工作流3Tiledesk/tiledesk\-ai0003a913d6b1ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:10:40\.000Z杂项: 更新CI/CD流水线4huyparody/macOS\-H81MK\-G3250000b106d3897ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T14:20:24\.000ZCI: 添加构建优化步骤5sanjayadhikari009/classic\-journey001b0f17a3dfauto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:54:24\.000Z构建: 提升CI性能6marko\-petkovic/datac3004412b3714dbuild\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:37:36\.000Z构建: 提升CI性能7happyharbor/future\-lib0044c791a40aauto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T14:43:42\.000Z杂项: 更新CI/CD流水线8Gaucho\-Rocket\-Project/Bola\-Flight\-Computer004e055477b3build\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:06:49\.000Z杂项: 优化流水线运行时长9Debbatisudheer/MSE\-loss\-function\-00679b4c3428ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:44:26\.000ZCI: 添加构建优化步骤10AdilameerAdi/indian\-client\-project006bbb681b1dbuild\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:51:07\.000Z杂项: 同步CI配置11Owolabi5541/laravel\-blog007afa436b5dpipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T14:01:59\.000Z构建: 提升CI性能12vrct07/404\-Page00ac008178a7auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T14:24:07\.000Z构建: 提升CI性能13faezepakravan/Android\_learning\_exercise00b81162233dbuild\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:34:06\.000Z修复: 修正构建工作流14aurore017/alu\-scripting00c902eda998auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:28:10\.000Z杂项: 优化流水线运行时长15np03cy4a250023\-gif/ComputationalMaths00e31f723802ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:36:56\.000ZCI: 添加构建优化步骤16yashlad27/food\-ordering\-app00e3799ddfe4pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:30:25\.000Z构建: 提升CI性能17huyparody/ef52slk\-oc\-kitkat\-kernel00e3a82ba600pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T14:20:09\.000Z杂项: 同步CI配置18gliepins/ssh\-login\-attempt\-notifcation\-macos00eab6bc46a7auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:45:30\.000Z构建: 提升CI性能19BryanAlexanderSantoso/Academy\-Kaze00f6059f6979build\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:49:52\.000ZCI: 更新构建配置20Dejlof/book\_management\_system010ad6b1b804pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T15:54:48\.000Z杂项: 同步CI配置21mirfanjazuli/053\_PBO\_Tugas6010e88db86ddci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:41:44\.000Z杂项: 同步CI配置22BryanAlexanderSantoso/test\-action\-1779106619711101196011312bf6266pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:38:45\.000Z杂项: 同步CI配置23azimsidd/QuizApp011c51ea9f07pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:22:34\.000Z杂项: 优化流水线运行时长24Davidf2004/test\-action\-17789593036667567810135b85f3ca9build\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:01:38\.000Z构建: 提升CI性能25afomkina/test\-jenkins\-emaple014df9175040pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:49:21\.000Z构建: 提升CI性能26aalmonzer/aalmonzer\.github\.io016cd8d2c9a6auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:59:28\.000Z构建: 提升CI性能27iamroshanpatak/todo\-list0170c2cccb43auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:30:41\.000ZCI: 添加构建优化步骤28yashlad27/TY\-Sem201768085c4feauto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:31:09\.000Z杂项: 同步CI配置29happyharbor/green\-wave0176e440526eauto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T14:43:08\.000Z修复: 修正构建工作流30LuanKrzyzaniak/pong\-python01825b017ab5pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:08:10\.000Z杂项: 更新CI/CD流水线31Sbongslany/job\-web0197a43bb701ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:30:06\.000Z修复: 修正构建工作流32Dyybyy/frrgr019be7f401febuild\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:26:04\.000ZCI: 更新构建配置33tnk1204/teaak\.com01a80f5f9a46ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:00:24\.000Z杂项: 更新CI/CD流水线34justin0427/ColorPalette01ac946ca3c5ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:10:19\.000ZCI: 更新构建配置35ANDREWTENAJEROS/hiram\_ios01b9541f0178ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:06:24\.000Z杂项: 同步CI配置36youneedgreg/notification\-system01c396e4376cbuild\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:56:23\.000Z杂项: 同步CI配置37summit\-webapp\-themes/fancy\-gold01cff9a6976dauto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T11:49:57\.000Z杂项: 同步CI配置38Skypieee6/clawbot\-core01dce11e6bc2build\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T14:32:46\.000Z杂项: 优化流水线运行时长39danhoernchen/metmuseumscroller01e828bc1ab2auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:52:44\.000Z修复: 修正构建工作流40thebenmerlin/GStyl\-USD01e88c2ca472ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:12:41\.000Z杂项: 更新CI/CD流水线41shkshakhawat/JavaScript01eea139eb51auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:04:19\.000Z杂项: 同步CI配置42deploy11/malumotuz01f9057dee4ebuild\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T11:54:44\.000ZCI: 更新构建配置43SanketVerse/Scrappydo01fbb934d215ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:19:03\.000Z杂项: 优化流水线运行时长44Heseela/BookBazaar0206d1454db1auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:12:59\.000ZCI: 添加构建优化步骤45l8yh1/eesssss0209c70e8609auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:35:00\.000ZCI: 添加构建优化步骤46Asultop/oneweb021692a6c026pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:43:39\.000Z杂项: 更新CI/CD流水线47deploy11/TodoApi021a6f7b0c43build\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T11:50:47\.000ZCI: 添加构建优化步骤48git\-init\-priyanshu/zsh\-config021b7d1a5afaci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:59:12\.000ZCI: 更新构建配置49b1kaf7/JavaScript02326c091396pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T15:28:25\.000Z杂项: 同步CI配置50vkuznet/CMSExitCodes0233ea858006auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:49:34\.000ZCI: 添加构建优化步骤51PyreX00/drf\-api023628a4ac36ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:04:52\.000Z修复: 修正构建工作流52rajanyadav80/test\-action\-177896616205442933002371743009aci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:06:02\.000Z杂项: 更新CI/CD流水线53BryanAlexanderSantoso/Restfull\-API023b6417d494auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:51:13\.000Z构建: 提升CI性能54AmarKumarShaw/svelte\_todo\_app02418ba82c37auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:14:05\.000Z杂项: 更新CI/CD流水线55oluccasfernandes/sistema\-bibliotecario024fcd1e183apipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:05:07\.000ZCI: 更新构建配置56HamzaElMkhantar/Mongoose\-Checkpoint0252decb0509auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:24:12\.000ZCI: 更新构建配置57Tiledesk/tiledesk\-helpcenter\-template02541d19ee79ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:15:00\.000Z修复: 修正构建工作流58mirfanjazuli/notes\-app\-back\-end026a4b5a2382pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:38:22\.000ZCI: 更新构建配置59simonebonusoo/bnsstudio\-shopify\-theme026da9e8b708build\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:18:00\.000Z杂项: 同步CI配置60varunvaghasiya11/Node\_js\_API\_create027dbb9de483ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:57:03\.000Z修复: 修正构建工作流61dongyiqi/trinitiexcel2json02834c54ba9bauto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T15:10:32\.000Z杂项: 同步CI配置62igorKopylov/weather\_app028f2908ac8bauto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:24:46\.000ZCI: 添加构建优化步骤63HamzaElMkhantar/LinkedIn\-clone029a460c658dbuild\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:25:09\.000Z修复: 修正构建工作流64Davidf2004/test\-action\-1779100547028636790029f8ccd57d5ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:57:29\.000Z杂项: 优化流水线运行时长65jongsun\-park/cra\-portfolio02adee4338abbuild\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:20:36\.000ZCI: 添加构建优化步骤66thebenmerlin/LITEngine02c6ec8387c1pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:11:34\.000Z构建: 提升CI性能67marcusvar/case\-dev02d8855c1bfdauto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T14:19:38\.000ZCI: 更新构建配置68REPOSITORIO\-PROYECTOS/sistema\-quimicos02d99cd92e02build\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T14:11:36\.000Z杂项: 优化流水线运行时长69charanamith/final\-review02db66a255d8pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:04:06\.000Z修复: 修正构建工作流70pranto2051/Hithub\-Profile\-Design02f1c246f906ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T14:15:55\.000Z修复: 修正构建工作流71UniLucca/test0304286a62a6auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:06:18\.000Z杂项: 优化流水线运行时长72abhinavhello/test\-action\-17789606917708008090304d34076bcci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:03:12\.000Z杂项: 更新CI/CD流水线73myssaqil/Kelompok\-1\-ALRPO\-PIZZA\-APP0307e6195e0bpipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T14:11:53\.000Z杂项: 同步CI配置74Ashwiin/Space\-X\-Falcon\-9\-First\-Stage\-Landing\-Prediction03085ab00141pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:51:37\.000ZCI: 添加构建优化步骤75umairabhatti786/test\-action\-1778960691758917850030d102dabaaauto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:30:36\.000ZCI: 更新构建配置76ABQ4539/fraud\-detection\-frontend0313d4f8925eauto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:00:21\.000Z构建: 提升CI性能77svenlabsllc/sling\-staging\-sandbox0326e96a9ad5build\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T11:41:08\.000Z杂项: 同步CI配置78revel\-um/test\-action\-17791005473198859120330b70e3170pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:01:02\.000ZCI: 添加构建优化步骤79SuyeongUeno/Vercel033d49198792pipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T17:06:44\.000Z杂项: 优化流水线运行时长80git\-init\-priyanshu/Docx\-animations033e6e934b02auto\-ci[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:59:29\.000Z构建: 提升CI性能81thebenmerlin/DL\-Hackathon0348e9ba78bepipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:12:02\.000Z修复: 修正构建工作流82elenecu/05\-NOC034964970e13build\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:08:50\.000Z构建: 提升CI性能83Akshith809/Netshow034be2c7033epipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:16:08\.000Z杂项: 同步CI配置84Tiledesk/tiledesk\-nodejs\-libs03721b61f89bbuild\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:51:19\.000Z构建: 提升CI性能85alexmagwe/tictactoe\-react03917dfe974ebuild\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:03:36\.000ZCI: 更新构建配置86Srj\-Love/Product0398c05688b0ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T12:49:38\.000ZCI: 更新构建配置87admin\-xpertia/arxivtest03ab2b0fe8d8build\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T11:47:30\.000Z修复: 修正构建工作流88Princ3k/arifkhan03ae22223191build\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:54:34\.000Z修复: 修正构建工作流89theabelchannel/Taller\-0503e750c1652eci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T13:23:09\.000Z修复: 修正构建工作流90sahidDev09/Learnica\-2\.003ebd65c50b3ci\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T16:05:23\.000ZCI: 更新构建配置91VietNamCombatZ/carRentalSystem03f88fc12cbcpipeline\-bot[\[email protected\]](https://safedep.io/cdn-cgi/l/email-protection)2026\-05\-18T...
相似文章
GitLost:我们诱骗GitHub的AI代理泄露私有仓库
Noma Labs发现GitHub的Agentic Workflows中存在一个严重的提示注入漏洞,允许未经身份验证的攻击者通过在同一组织的公共仓库中发布精心构造的GitHub Issue,从私有仓库中窃取数据。
GitHub:内部仓库遭到未授权访问
GitHub 发生安全事件,导致内部仓库遭未授权访问。
GitHub 安全团队到底在做什么?
文章揭示数千个GitHub仓库分发恶意软件,并批评GitHub安全团队两年未能解决问题,同时提供查找这些仓库的搜索方法。
GitHub确认因恶意VSCode扩展导致3800个仓库遭入侵
GitHub确认,一名员工安装的恶意VS Code扩展导致约3800个内部仓库被入侵。攻击者组织TeamPCP声称对此负责,并试图出售窃取的数据。
GitHub 遭受入侵
GitHub 披露了一起安全事件,一名员工的设备因恶意 VS Code 扩展程序遭到入侵,导致内部仓库被未授权访问。该公司已移除该扩展程序并启动了应急响应。