Breaking

Suspected Lone Attacker Hits 61 GitHub Repositories, Including Google's LangExtract, Radware Says

October 30, 2026 at 11:52 EDT

Security
Software Dev & Coding

A suspected lone attacker compromised or targeted 61 GitHub repositories, including Google's LangExtract, Trivy and Brave, by publishing 83 manipulated posts in about 45 minutes, according to security firm Radware.

Supply chain attack · GitHub repositories

One suspected attacker, 83 poisoned posts, 61 repositories

Hidden commands in HTML comments aimed to make CI/CD pipelines leak access tokens and credentials. Affected projects include Google's LangExtract, Trivy and Brave.

GitHub repositories targeted or compromised

Manipulated posts published

~45 min

Window in which the posts appeared

2×

Times the malicious code was observed running

Scale of the campaign (reported counts)

Column height is proportional to each count. Both values are numbers of items.

Posts

Repositories

Roughly 1.4 posts for every repository affected, delivered within about 45 minutes.

How the attack was designed to work

STEP 1

Commands hidden in HTML comments, invisible on the rendered page

→

STEP 2

CI/CD pipeline processes the text as if it were trusted input

→

STEP 3

Pipeline runs the hidden commands with its own access

→

GOAL

Tokens and credentials leak out of the pipeline

Why it matters

The targets are developer tools many other projects depend on.
Projects of very different kinds were hit, not one company.

What is still unknown

Whether any data was actually taken
Whether the figures have been independently conf

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.