Megalodon Swarms GitHub: Over 5,500 Repos Poisoned in Massive Supply‑Chain Assault

On Monday, 18 May 2026, a threat‑actor behind the Megalodon campaign pushed malicious commits to 5,561 public and private GitHub repositories. The commits were made under the bogus author name build‑bot (email [email protected]) and appeared without any pull‑request or review, suggesting the attacker used a compromised personal access token (PAT) or a stolen deploy key.

The malware is a CI/CD credential‑stealer. Once a poisoned commit is merged, the code runs inside the victim’s CI pipeline and:

• Scrapes AWS secret keys, Google Cloud access tokens and Azure instance‑metadata credentials.
• Reads SSH private keys, Docker/Kubernetes config files, HashiCorp Vault tokens, Terraform credentials, and scans source code for more than 30 secret‑regex patterns.
• Exfiltrates GitHub, Bitbucket and npm tokens, enabling the attacker to impersonate developers and push further malicious code.

The campaign mirrors the earlier TeamPCP supply‑chain attacks that compromised roughly 3,800 repos, but Megalodon is larger in scale and more aggressive in credential theft.

---

Legal Basis: Why GDPR, CCPA and Other Regimes Matter

GDPR (EU)

• Article 5(1)(f) requires personal data to be processed securely. The exposure of developer credentials, cloud‑service tokens and potentially customer data stored in compromised environments constitutes a breach of that principle.
• Article 33 obliges data controllers to notify the supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of individuals. Companies whose CI pipelines were tainted must assess whether the breach meets this threshold.
• Article 32 mandates appropriate technical and organisational measures. The lack of protected branch policies, mandatory code‑review workflows and secret‑scanning tools could be deemed a failure to implement “state‑of‑the‑art” safeguards.

CCPA (California)

• Section 1798.150 defines a data breach as the unauthorized acquisition of personal information. If the stolen tokens grant access to databases containing California residents’ data, the incident triggers the CCPA breach‑notification requirements.
• Section 1798.105 requires reasonable security practices. The absence of secret‑scanning in CI pipelines may be viewed as falling short of “reasonable” standards, exposing companies to civil penalties of up to $7,500 per violation.

Other Jurisdictions

• Australia’s Privacy Act (APP 11) and Brazil’s LGPD impose similar obligations to protect personal data and report breaches. Multinational firms could face simultaneous investigations across several regulators.

---

Impact on Users and Companies

Affected Party	What Was Stolen	Potential Consequence
Developers	GitHub tokens, SSH keys, cloud credentials	Account takeover, lateral movement into production environments
Enterprises	Cloud‑provider access, Terraform state files, internal Docker images	Unauthorized cloud spend, data exfiltration, ransomware insertion
End‑users	Personal data stored in compromised cloud services	Identity theft, loss of privacy, possible regulatory fines
Open‑source maintainers	Reputation damage, loss of trust in supply‑chain processes	Decreased contributions, slower adoption of their projects

Because the malicious code runs inside the victim’s own CI environment, the attack bypasses many perimeter defenses. Once the attacker obtains a cloud‑provider token, they can spin up resources, read storage buckets, or even delete logs, making forensic analysis difficult.

---

What Changes Are Needed?

1. Harden CI/CD Pipelines

• Enforce branch protection rules that require at least one approved review before merging.
• Deploy secret‑scanning tools (e.g., GitGuardian, TruffleHog) as part of the CI workflow to block commits containing credentials.
• Rotate PATs and deploy keys every 90 days and store them in a dedicated secret‑management solution rather than hard‑coding them.

2. Adopt Supply‑Chain Security Standards

• Follow the NIST SP 800‑161 guidance for software supply‑chain risk management.
• Implement the SLSA (Supply‑Chain Levels for Software Artifacts) framework; aim for at least Level 2 (authenticated provenance) for all public packages.
• Use SBOMs (Software Bill of Materials) to track third‑party components and detect unexpected changes.

3. Legal and Compliance Actions

• Conduct a data‑protection impact assessment (DPIA) under GDPR to determine whether the breach poses a high risk to individuals.
• If required, issue breach notifications to supervisory authorities and affected data subjects within the statutory 72‑hour window.
• Review contracts with cloud providers; many now offer incident‑response add‑ons that can help contain credential misuse.

4. Platform‑Level Responsibility

• GitHub should automatically quarantine repositories that receive commits from newly created PATs without prior reputation, similar to the recent GitHub Advanced Security “code scanning” alerts.
• npm must continue to invalidate granular access tokens that allow write access without 2FA, and consider mandatory token‑revocation when a repository is flagged for supply‑chain compromise.

---

The Bigger Picture: Why This Is a Rights Issue

Supply‑chain attacks like Megalodon do not just threaten corporate assets; they jeopardise the privacy rights of every individual whose data lives in the cloud. When a developer’s secret key is stolen, the attacker can harvest user databases, logs and analytics that contain names, emails, location data and even health information. Under GDPR and CCPA, those individuals have a legal entitlement to prompt, transparent notification and, in many cases, the right to remedy (e.g., credit‑monitoring services).

The watchdog community therefore calls on platforms, open‑source maintainers and enterprises to treat code integrity as a fundamental human‑rights issue. Failure to do so not only invites hefty fines but also erodes public trust in the digital infrastructure that underpins modern life.

---

For further technical details, see the full list of compromised repositories published by SafeDep and the accompanying blog post by Ox Security lead researcher Moshe Siman Tov Bustan.