Attackers compromised 42 GitHub repositories by using files too large to be searched
Summary
Attackers have compromised 42 GitHub repositories by deploying large payload blobs that evade standard search mechanisms. These compromised repositories contained execution hooks for AI coding assistants and IDEs, along with polymorphic wrappers that decoded to a hidden CI-publisher payload. The campaign also involved account hijacks, forged commit timelines, and exposed npm credentials, linking these GitHub compromises to previous exploitation of cPanel systems.
IFF Assessment
This article details a sophisticated attack that compromised numerous repositories, representing a significant threat to software supply chain integrity and a setback for defenders.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: May 03, 2026. Known ransomware use: Known.
Defender Context
This incident highlights the growing sophistication of supply chain attacks, particularly targeting code repositories and AI development tools. Defenders need to enhance their monitoring for unusual file sizes, obfuscated payloads, and suspicious commit activities within their development environments. Furthermore, vigilance against novel evasion techniques that bypass common search and detection methods is crucial.