A threat campaign designated ‘Megalodon’ compromised more than 5,500 public GitHub repositories within a six-hour window, extracting GitHub Actions secrets and developer credentials at scale using purpose-built automation. Any organization whose CI/CD pipelines consume or depend on affected repositories faces downstream exposure; stolen credentials could enable unauthorized access to production environments, cloud accounts, and internal systems. This is a high-priority software supply chain event requiring immediate audit of repository secrets and CI/CD pipeline dependencies.