Malware leveraging public infrastructure like GitHub on the rise

Executive summary: ReversingLabs discovered a software supply-chain campaign where malicious PyPI packages hide code in setup.py to fetch and execute payloads or commands hosted on GitHub — notably using secret Gists and Base64-encoded git commit messages as C2/payload delivery mechanisms — delivering infostealer and RAT second stages and providing IOCs for detection and response.