He filtered 16M GitHub pushes and found 10,000 repos pushing the same Trojan (orchidfiles.com)
It started with one copied repo carrying a link to a zip archive. The clone re-pushed an identical commit every few hours to stay at the top of GitHub's 'recently updated' list and out-rank the original in search.
To measure the scale, the author parsed 16 million commit pushes from GHArchive over five days. Of 40,000 repos updating 1-24 times a day, exactly 10,000 matched the campaign's fingerprint. Submit the download link to VirusTotal: zero hits. Submit the zip itself: Trojan.
Sign in to save