Radware researchers found 83 malicious issues, pull requests and comments across 61 public repositories, with commands hidden in HTML comments. Workflows that put that text into shell steps ran the commands and tried to send environment variables to an attacker server. Targets included MLflow and Google LangExtract. Radware could not confirm any code changes or downstream compromise. Teams should limit workflow permissions and secrets, and separate jobs triggered by outside content from privileged ones.
