Analysis of 10,000 Malicious GitHub Repositories
I found 10,000 repositories on GitHub that distribute Trojan malware. They aren't forks of a single malicious project, and they aren't all coming from one bad actor. They're spread across different contributors with different names, all just sitting there in plain sight. I stumbled into this by accident. I have a project on GitHub and wanted to see if search engines had indexed it, so I typed the project name into Google. My repository showed up in the results, but it was surrounded by a weird pattern of others that looked almost identical in structure but served a completely different purpose. It's a clever play on trust. We tend to treat GitHub as a safe harbor for code, but these repos use that reputation to trick developers into downloading payloads. I spent some time digging through the data to see how deep the hole goes. The results are honestly a bit unsettling. The scale of the infection The campaign hit 10,000 repositories. The attackers didn't ...