Software Supply-Chain Attacks Abusing GitHub and npm Dependency Mechanisms

Security researchers reported two distinct software supply-chain abuse paths that can make malicious code appear to originate from trusted sources. GMO Cybersecurity by Ierae described an active campaign dubbed “repo squatting” that abuses how GitHub renders and links commits from forks: a commit made in an attacker-controlled fork can be viewed under the upstream project’s URL structure, enabling convincing links like github.com/<official-org>/<repo>/commit/<hash> that appear to belong to the official repository. The campaign targeted the GitHub Desktop project by distributing a trojanized installer carrying HijackLoader, with the malicious download link presented in a way that could mislead users and some security tooling into believing it came from the official repo.

Separately, Koi researchers disclosed PackageGate weaknesses in JavaScript dependency tooling that allow bypassing npm’s post–Shai-Hulud mitigations when installing Git-based dependencies. They reported that a malicious .npmrc in a Git dependency can override the git binary path, enabling code execution even when lifecycle scripts are disabled (e.g., --ignore-scripts=true), affecting multiple tools (including pnpm, vlt, Bun, and npm). Vendors reportedly addressed the issue in the non-npm tools, while npm closed the report as “works as expected,” and researchers cited evidence of prior proof-of-concept abuse (e.g., reverse shell) indicating practical exploitation risk for organizations relying on Git dependencies in CI/CD and developer environments.