Hackers Compromised 10,000+ GitHub Repositories to Inject Malicious Script

A researcher uncovered a large-scale GitHub malware campaign in which attackers cloned legitimate repositories (preserving commit history and contributor metadata) and periodically inserted README links to ZIP archives that contained Trojan malware. The operation used evasion techniques—including splitting payloads across files and repeatedly updating README commits—to reduce automated detection, and an analysis of GH Archive data identified approximately 10,000 affected repositories that had remained undetected for extended periods.