GitHub struggles to keep up with automated malicious forks

A widespread supply-chain malware campaign started with malicious Python packages and moved to GitHub, where adversaries cloned and poisoned legitimate repositories with a modified BlackCap-Grabber infostealer that steals credentials and exfiltrates data to C2 servers; attackers automated account/repo creation, mass-forking (resulting in at least ~100,000 compromised repositories), and used evasion techniques like "exec smuggling" to hamper detection and manual review.