Hackers Hijack GitHub Accounts in Supply Chain Attack Affecting Top-gg and Others

Unidentified adversaries ran a supply-chain campaign by hosting trojanized Python packages on a typosquatted PyPI mirror (files.pypihosted.org) and performing GitHub account takeovers (via stolen browser cookies) to commit malicious changes to repositories' requirements.txt; the malicious colorama package (a widely used library) triggered a multi-stage infostealer that fetches remote code, persists via Windows Registry changes, and exfiltrates credentials, browser data, crypto wallets, and messaging tokens to anonymous file-sharing services or attacker infrastructure—Cloudflare and repository maintainers have since removed the fake domain and some malicious repositories.