GitGot: GitHub leveraged by cybercriminals to store stolen data

ReversingLabs discovered two malicious npm packages (warbeast2000 and kodiak2k) that executed postinstall scripts to read SSH private keys (e.g., id_rsa or a file named “meow”) from users' ~/.ssh directories, Base64-encoded the keys, and uploaded them to attacker-controlled GitHub repositories; kodiak2k also exhibited references to the Empire framework and Mimikatz in later versions, suggesting additional post-exploitation capabilities. Both packages were reported and removed from npm after limited distribution (~400 and ~950 downloads), but the campaign highlights growing abuse of open-source package ecosystems and GitHub for data exfiltration and command-and-control.