Millions of Malicious Repositories Flood GitHub

GitHub and cyberattackers are waging a quiet, automated war over malicious repos.

Cyberattackers in just the last few months have registered more than 100,000 — but by some estimates more than a million — malicious copycat repositories on GitHub.
The repo confusion scheme is simple: programmatically copying, Trojanizing, and reuploading existing repos, hoping that developers download the wrong one.
GitHubs automatic security mechanisms seem to be identifying and removing the majority of these cheap fakes, but according to new
research from Apiiro
, plenty are still seeping through the cracks.
Repo confusion works just like
dependency confusion in package managers
, tricking unwitting developers into downloading near-identical copies of the code they actually want, with malware quietly added as a bonus.
This malware, in turn, becomes incorporated into software projects and causes
downstream supply chain risks
.
The key to success with this latest campaign is automation. The attacker has been cloning, infecting, and reuploading repositories automatically at scale, pushing what researchers estimate are millions of repositories in all. And to add legitimacy, the automation process forks these projects thousands of times apiece, and promotes them across various Web forums and apps.
So when sleep-deprived or multitasking developers fork the copycat instead of the original, theyll be served a heavily obfuscated copy of the BlackCap Grabber, which collects credentials from various apps, browser cookies, and other data, in addition to other malicious functions.
GitHub, for its part, has been taking down most of these malicious repos within hours of their posting.
However, the automation detection seems to miss many repos, and the ones that were uploaded manually survive. Because the whole attack chain seems to be mostly automated on a large scale, the 1% that survive still amount to thousands of malicious repos, Apiiro explained in its blog post.
A GitHub spokesperson said the organization is working on extracting the malicious code. GitHub hosts over 100M developers building across over 420M repositories, and is committed to providing a safe and secure platform for developers. We have teams dedicated to detecting, analyzing, and removing content and accounts that violate our Acceptable Use Policies. We employ manual reviews and at-scale detections that use machine learning and constantly evolve and adapt to adversarial tactics, the spokesperson said in a statement. We also encourage customers and community members to report abuse and spam.
GitHub by nature offers certain advantages for confusion attacks. The ease of automatic generation of accounts and repos on GitHub and alike, using comfortable APIs and soft rate limits that are easy to bypass, combined with the huge number of repos to hide among, make it a perfect target for covertly infecting the software supply chain, Apiiro wrote.
Shawn Loveland, chief operating officer of Resecurity, points out two additional problems. Ones a tradeoff of privacy versus security: GitHubs not looking at repos, but then criminals can leverage them, Loveland says. And the other one is just the sheer number of GitHub accounts that are compromised, which allows bad actors to get into private repos and then go off and make duplicates.
Cybercriminals can also copy public repos without this extra access.
I just looked in our database, Loveland notes. Almost 100,000 PCs of users logging in to GitHub were infected with malware in the last 90 days.
How can organizations protect themselves from both direct and downstream effects of a malicious GitHub repo? Companies need to have a policy about using GitHub [that is] communicated with their employees and vendors, even if they themselves dont use GitHub, he suggests, because even companies that dont directly engage with third-party code rely on developers at some point in their supply chains.
Even a company that doesnt have anyone using GitHub can still be victimized, Loveland says.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Millions of Malicious Repositories Flood GitHub