GitHub dismissed security reports on flaws now exploited by supply-chain worm, researchers say

Researchers warn that variants of the Shai-Hulud supply-chain worm—originating with the TeamPCP cybercrime group—are infecting hundreds of software packages and developer accounts; formal vulnerability reports submitted to GitHub were rejected as ineligible, and copycat variants have been linked to breaches at the European Commission, Mercor, the LiteLLM package, GitHub, and Red Hat.