Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows

This collection of reports highlights a spike in supply-chain and active exploitation incidents: the automated 'Megalodon' campaign injected malicious GitHub Actions workflows into thousands of repositories to exfiltrate CI secrets; multiple GitHub breaches (including a poisoned Nx Console VS Code extension and an employee-device compromise) led to exfiltration of internal repos; and Grafana was breached via a tainted TanStack npm package. Major exploited or high-severity vulnerabilities and proofs-of-concept were disclosed or added to KEV — notable entries include Cisco Secure Workload (CVE-2