GitHub Repo Confusion Campaign Injected Malware Into Forked Repositories

GitHub has been hit by a large-scale repo confusion campaign in which attackers fork legitimate projects, keep names and appearances close to the originals, and inject heavily obfuscated malicious code intended to steal passwords, cryptocurrency wallets, and other developer secrets. Apiiro reported that the operation was largely automated and tied to more than 100,000 infected repositories, while Ars Technica said the broader attack generated millions of malicious repositories and exploited the difficulty users face distinguishing authentic projects from poisoned forks.

Multiple GitHub repositories later carried security issues warning that malicious code had been injected via compromised accounts, including projects such as django-restful-admin, ImportNURBS, siriraj-assist, ood_coverage, issued, and bottom-up-attention-vqa. The notices indicate the campaign was not limited to fake lookalike repos but also reached legitimate codebases through account compromise, extending the supply-chain risk to developers who clone, fork, or build from affected repositories while GitHub continues removing abusive content through reporting, manual review, and machine-learning-based detection.