Full Report
An unknown threat actor has been conducting an opportunistic campaign of automated malicious pull requests to attempt to initiate supply chain compromise against various open source repositories. In at least two cases, the attacker has been able to inject malicious code that u...
Analysis Summary
# Morning News Roll-up 2026-04-29
## Overview
A sophisticated, potentially AI-enabled supply chain campaign is targeting GitHub repositories via automated malicious pull requests. The actor has successfully compromised at least two npm packages by exploiting CI/CD workflows, demonstrating a high degree of technical adaptability.
## Top Stories
### Exploitation Campaign of Vulnerable GitHub Workflows
- Summary: An unknown actor is conducting an opportunistic campaign using automated pull requests to inject malicious code into open-source repositories. The attacker uses AI-driven techniques to identify framework-specific injection points and npm scripts to trigger malicious execution during CI/CD processes.
- Source: hxxps://threats[.]wiz[.]io/all-incidents/exploitation-campaign-of-vulnerable-github-workflows
# AI-Enabled Automated Supply Chain Campaign
An unknown threat actor is executing an opportunistic, high-frequency campaign targeting open-source repositories via automated malicious pull requests (PRs). The primary goal is to achieve supply chain compromise by injecting code that executes during the Continuous Integration (CI) phase, leading to the unauthorized release of malicious npm packages.
## Key Points
- **Scale and Velocity:** The campaign has targeted over 200 repositories with a deployment frequency of approximately 7 PRs per hour.
- **Success Rate:** While the majority of attempts fail, the actor maintains a 10% success rate and has successfully compromised at least two npm package releases.
- **AI-Driven Adaptability:** The campaign is believed to be AI-enabled due to its ability to dynamically identify languages, frameworks, and test runners to create idiomatic code wrappers for injections.
- **CI/CD Exploitation:** The attack specifically targets the CI configuration to ensure malicious code runs automatically when the PR is processed.
## Threat Actors
- **Attribution:** Currently unknown.
- **Characteristics:** Highly automated, persistent, and capable of tailoring scripts to specific repository environments.
- **Motivation:** Supply chain compromise and unauthorized package distribution.
## TTPs
- **Malicious Pull Request Submission:** Automated delivery of code changes to public repositories.
- **Dynamic Analysis:** Automated identification of CI configurations, frameworks, and test runners (e.g., npm, GitHub Actions).
- **Hook Injection:** Optimizing triggers by injecting malicious npm scripts into multiple lifecycle hooks to ensure execution during testing or building.
- **Idiomatic Code Generation:** Use of AI to generate wrapper code that blends in with the target repository's existing coding style.
## Affected Systems
- **Platforms:** GitHub, npm.
- **Technologies:** Open-source repositories utilizing automated CI/CD workflows and npm package managers.
- **Scope:** Over 200 repositories targeted globally.
## Mitigations
- **Branch Protection Rules:** Require mandatory code reviews from trusted maintainers before any PR can trigger CI workflows.
- **CI/CD Security:** Restrict the permissions of GITHUB_TOKEN and ensure secrets are not accessible to PRs from forks.
- **Script Auditing:** Monitor for unauthorized changes to `package.json` lifecycle hooks (e.g., `preinstall`, `test`, `postinstall`).
- **Automated Scanning:** Utilize tools to detect anomalous patterns in PRs, such as high-frequency submissions from new or unknown accounts.
## Conclusion
This campaign represents a shift toward automated, intelligent supply chain attacks. By leveraging AI to adapt to different coding environments, the actor has bypassed standard filters in multiple instances. Organizations managing open-source projects should immediately enforce strict PR review policies and harden their CI/CD pipelines to prevent unauthorized code execution.