CMPC Research / Independent Cybersecurity Research
Investigating threats.Sharing the evidence.
Independent investigations into malicious repositories, attacker infrastructure, and software supply-chain abuse.
Cristian Chiriac · Independent Security Researcher
Lead investigation · Part 4 of 12 · Software Supply Chain Security
PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories
Pinned-commit proof, hidden loaders, propagation and the blockchain-based payload chain.
The owner-wide expansion documents scale beyond the largest public count found in the reviewed sources, together with rewritten-history and pull-request evidence.
- Already public
- Up to 1,951 repositories under 1,047 owners (OpenSourceMalware, updated 11 April 2026).
- What this investigation adds
- 40,136 repositories under 3,334 accounts, each proven at a pinned default-branch commit on 30–31 October 2026.See the evidence →
Latest developments
2 November 2026
Published: The AUTH_API_KEY Loader in 649 GitHub Repositories
Source: the article2 November 2026
Published: Cheat and Crack Lures on GitHub
Source: the article2 November 2026
Published: Contagious Interview: Fake Coding Tests and Execution Triggers
Source: the article
The series · 12 articles
GitHub threat investigation, 2026
Starting from one antivirus alert, which malicious activities sit in public GitHub repositories, and how many repositories can be proven file by file, at a fixed commit, under a rule decided before the count?
01 · Threat Intelligence7 min
From a Defender Alert to 43,448 GitHub Repositories Linked to Malicious Activity
Static analysis of public GitHub repositories proved 43,448 GitHub repositories linked to malicious activity under 4,250 accounts across nine activities, from PolinRider to Contagious Interview.
02 · Malware Analysis12 min
Contagious Interview: Fake Coding Tests and Execution Triggers
The examined projects expose three trigger paths, including folder-open tasks that arm a checkout hook.
03 · Threat Intelligence30 min
Contagious Interview: Public Servers, Infrastructure and Payloads
The first 15 server repositories retain 375 history entries; the examined source connects changing infrastructure with delivery and payload configuration.
04 · Software Supply Chain Security · Lead21 min
PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories
The owner-wide expansion documents scale beyond the largest public count found in the reviewed sources, together with rewritten-history and pull-request evidence.
05 · Software Supply Chain Security6 min
The AUTH_API_KEY Loader in 649 GitHub Repositories
The pinned-commit set and decoded host inventory quantify a publicly described pattern; 193 owners also appear in the PolinRider set.
06 · Malware Analysis2 min
Older Malware Still Public on GitHub
The contribution is the pinned-commit count and the separation of published tools from affected project copies.
07 · Software Supply Chain Security5 min
D1337: Cryptomining in Other People's GitHub Actions
The research identifies the workflow cluster, its signing identity and the shared payout configuration in unrelated developer accounts.
08 · Malware Analysis6 min
Fake CVE Exploits Delivering SmartLoader
The research records hashes, identical archive-entry layouts with different archive hashes, and detection results for the examined set.
09 · Malware Analysis10 min
Cheat and Crack Lures on GitHub
The research documents the hub-and-spoke structure and separates 12 lures proven by malware-family hashes from 1,422 that only link suspected hubs.
10 · Threat Intelligence6 min
Trading-Bot Pages with Hidden Download Links
The reviewed analysis records a 15-account farm, the decoded destination and user-agent cloaking logic.
11 · Threat Intelligence4 min
Fake GitHub Security Alerts Delivered Through Issues
This observed set documents a 2026 use of the template through an own-repository notification path, rather than a broad campaign count.
12 · Threat Intelligence16 min
How the GitHub Investigation Was Verified
The method records rejected candidates and an independent second-API recheck instead of treating search results as proof.
Focus
Research Areas
- 01
AI Agent Security
- 02Malware Analysis · 4
- 03Threat Intelligence · 5
- 04
Detection Engineering
- 05
Vulnerability Research
- 06Software Supply Chain Security · 3
Approach
Research Approach
Evidence-based, reproducible, and defense-oriented. Confirmed and suspected findings are kept separate, confidence is stated explicitly, and every publication carries its limitations.
Read the methodology →The researcher
Cristian Chiriac
My interests span threat hunting, detection engineering, and the security of AI agents and software supply chains. I conduct this research independently in my spare time.