GitHub hit with another major attack – Megalodon hits over 5,000 repos with malware-laden commits
SafeDep researchers uncovered Megalodon, a TeamPCP-inspired campaign that infected over 5,500 GitHub repositories with an infostealer targeting CI/CD secrets The worm-like attack spreads via malicious exploits from a fake “build-bot” that steals cloud keys, SSH credentials and DevOps configurations, with npm packages like Tiledesk inadvertently published from poisoned repositories Unlike TeamPCP’s forum “competition”, Megalodon appears […]









