Attackers Can Generate Duplicate Verified GitHub Commits Using Signature Malleability

Researchers demonstrate "Git hash chain malleability": by altering signature encodings (ECDSA, RSA, EdDSA, S/MIME) without changing the signed payload, attackers can create new commit hashes that still validate and receive GitHub's "Verified" badge. Because Git includes signatures in the hashed object, malleated commits and their rewritten descendants produce fresh hashes that bypass SHA-based blocking, pinning, and provenance assumptions, exposing dependency and CI/CD supply-chain controls to stealthy substitution attacks. Defenders should canonicalize and verify content before applying hash-based deduplication or blocking.