The Megalodon GitHub Actions attack hit 5,561 repos in 6 hours by looking exactly like your CI bot — technical breakdown inside

Just finished digging through the SafeDep report and a few corroborating sources on the Megalodon campaign that hit GitHub on May 18.

The short version: an automated attack pushed 5,718 malicious commits to 5,561 repositories in a six-hour window. The commits were authored under names like "build-bot", "auto-ci", "pipeline-bot" — with emails designed to look like noreply CI automation — and injected Base64-encoded bash payloads into GitHub Actions workflow files.

By May 21, the attacker's C2 (216.126.225[.]129:8443) had received 575K+ files and 449 GB of data. Still ongoing at last count.

What's technically interesting:

**Two payload variants:**
- *SysDiag*: Adds a new workflow file, triggers on every push + pull_request_target. Active exfiltration every pipeline run.
- *Optimize-Build*: Replaces existing workflows with workflow_dispatch. Dormant until the attacker fires it manually via the GitHub API. These are the scary ones.

**What gets stolen:**
- All CI environment variables
- AWS/GCP/Azure credentials (both static and IMDSv2 role-based)
- GitHub Actions OIDC tokens → direct cloud provider auth without static credentials
- SSH keys, Docker configs, .npmrc, kubeconfig, Vault tokens, Terraform creds
- 30+ secret regex pattern grep sweep across the entire workspace

The OIDC piece is the part that sticks with me. Rotating credentials post-breach doesn't help if the attacker can just mint a fresh OIDC token via a workflow_dispatch call on a repo you haven't audited yet.

**Detection:** Search your repo history for commits authored by `build-system@noreply[.]dev` or `ci-bot@automated[.]dev` around May 18.

Affected npm package: `@tiledesk/tiledesk-server` versions 2.18.6–2.18.12.

I covered the TanStack CVE-2026-45321 supply chain attack a couple weeks back which used the same OIDC exfiltration primitive, if you want background on how this attack surface works: https://www.techgines.com/post/tanstack-npm-supply-chain-attack-cve-2026-45321-teampcp

Full Megalodon breakdown with IOC table and remediation checklist: https://www.techgines.com/post/megalodon-github-actions-supply-chain-attack-safedep-2026

**Question for the community:** How many organisations actually audit their GitHub Actions permissions regularly? In my experience, most teams treat the Actions runner as a trusted internal system — but after this, it's clear it needs to be treated as a potential adversary foothold. Are people actually implementing SHA pinning and workflow approval gates in practice, or is it still mostly aspirational?