Reference
Glossary
- dead drop
- A public record the loader reads to learn its next step. In PolinRider, the latest memo of a TRON account (an Aptos account as fallback) points to a BNB Smart Chain transaction whose input holds the encrypted next stage.
- Used in: PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories
- defanged
- Written so it cannot be clicked or resolved as written, for example example[.]com or hxxps://. Every network indicator on this site is defanged.
- Used in: Contagious Interview: Fake Coding Tests and Execution Triggers, Contagious Interview: Public Servers, Infrastructure and Payloads, The AUTH_API_KEY Loader in 649 GitHub Repositories, How the GitHub Investigation Was Verified
- default branch
- The branch a repository shows by default. Counts are taken on default branches only; infected non-default branches were recorded separately and are not counted.
- Used in: From a Defender Alert to 43,448 GitHub Repositories Linked to Malicious Activity, Contagious Interview: Fake Coding Tests and Execution Triggers, Contagious Interview: Public Servers, Infrastructure and Payloads, PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories, The AUTH_API_KEY Loader in 649 GitHub Repositories, D1337: Cryptomining in Other People's GitHub Actions, How the GitHub Investigation Was Verified
- folder-open task
- A VS Code task in .vscode/tasks.json with "runOn": "folderOpen", which runs when the folder is opened in a trusted workspace.
- Used in: Contagious Interview: Fake Coding Tests and Execution Triggers, Contagious Interview: Public Servers, Infrastructure and Payloads, PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories
- fork-collector account
- An account holding thousands of forks. Seven such accounts, holding 7,500 to 89,800 repositories each, all of whose infected repositories were forks, were recorded but not scanned; the counts are a floor.
- Used in: PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories
- git object id
- The hash Git assigns to a file's exact contents. Recording it identifies the precise file that matched, independently of its path or of later edits.
- Used in: Contagious Interview: Fake Coding Tests and Execution Triggers, PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories, How the GitHub Investigation Was Verified
- inherited fork
- A fork whose malicious file is byte-identical to its parent's and was not modified in the fork. Such forks are counted and flagged, because removing the parent does not clean them; an account whose only infected repositories are such forks is listed as inherited, not compromised.
- Used in: PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories
- owner-wide expansion
- Listing and checking every public repository of each confirmed owner, repeated for each newly found owner until a round found none. It reaches repositories that code search does not index, including forks.
- Used in: PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories
- pinned commit
- A specific commit, identified by its hash, at which a repository was read. Every counted repository was proven at the default-branch commit recorded in the proof pass, so a later change to the repository does not change what was proven.
- Used in: From a Defender Alert to 43,448 GitHub Repositories Linked to Malicious Activity, Contagious Interview: Fake Coding Tests and Execution Triggers, Contagious Interview: Public Servers, Infrastructure and Payloads, PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories, The AUTH_API_KEY Loader in 649 GitHub Repositories, Older Malware Still Public on GitHub, D1337: Cryptomining in Other People's GitHub Actions, Fake CVE Exploits Delivering SmartLoader, Cheat and Crack Lures on GitHub, Trading-Bot Pages with Hidden Download Links, Fake GitHub Security Alerts Delivered Through Issues, How the GitHub Investigation Was Verified
- proof pass
- The 30–31 October 2026 re-read of every candidate at a pinned commit under fixed inclusion rules, followed by an independent re-read of a random sample of 555 repositories through a different API.
- Used in: From a Defender Alert to 43,448 GitHub Repositories Linked to Malicious Activity, Contagious Interview: Fake Coding Tests and Execution Triggers, Contagious Interview: Public Servers, Infrastructure and Payloads, PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories, The AUTH_API_KEY Loader in 649 GitHub Repositories, Older Malware Still Public on GitHub, D1337: Cryptomining in Other People's GitHub Actions, Fake CVE Exploits Delivering SmartLoader, Cheat and Crack Lures on GitHub, Trading-Bot Pages with Hidden Download Links, Fake GitHub Security Alerts Delivered Through Issues, How the GitHub Investigation Was Verified
- staging server
- In Contagious Interview, an Express server that answers platform-specific setup requests with a script that downloads and starts a Node.js program; requests that look like a browser or Postman get a harmless decoy. A separate payload server returns the obfuscated JavaScript stealer.
- Used in: Contagious Interview: Fake Coding Tests and Execution Triggers, Contagious Interview: Public Servers, Infrastructure and Payloads
- workspace trust
- VS Code's setting for unfamiliar folders: a folder that is not trusted opens in restricted mode, which stops folder-open tasks.
- Used in: Contagious Interview: Fake Coding Tests and Execution Triggers, PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories