GitHub Repository Hijacks Used to Distribute Malware to Developers

Researchers reported active software supply chain attacks in which legitimate GitHub accounts and repositories were compromised and then used to distribute malware to developers. In one case, the verified dev-protocol GitHub organization was hijacked and repurposed to host polished Polymarket trading-bot repositories that secretly pulled typosquatted npm dependencies. Running the project exfiltrated .env contents including wallet private keys to attacker-controlled infrastructure, performed host fingerprinting, and modified firewall settings to expose SSH access; victims were advised to rotate wallet and API secrets and inspect ~/.ssh/authorized_keys for persistence.

A separate but related GitHub-focused campaign, dubbed ForceMemo, involved takeover of developer accounts and force-pushes to hundreds of Python repositories so that malicious code was appended to files such as setup.py, main.py, and app.py while preserving original commit metadata. Anyone installing directly from those repos could trigger the payload, and the activity affected projects ranging from Django applications to ML and Streamlit code. A report on malicious npm packages posing as a Roblox Solara executor was excluded because it describes a different npm ecosystem campaign centered on Cipher stealer, not the GitHub account and repository hijacks used in the other incidents.