Radware: GitHub issue / PR comment injection campaign

What happened

• 83 malicious issues, PRs and comments across 61 repos, including LangExtract, Trivy and MLflow. HTML-comment shell commands targeted vulnerable workflows.

Sources

• https://daily.dev/posts/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour-qwkbo76ob

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.