12 results
Threat Intelligence
Static analysis of public GitHub repositories proved 43,448 GitHub repositories linked to malicious activity under 4,250 accounts across nine activities, from PolinRider to Contagious Interview.
Malware Analysis
The examined projects expose three trigger paths, including folder-open tasks that arm a checkout hook.
Threat Intelligence
The first 15 server repositories retain 375 history entries; the examined source connects changing infrastructure with delivery and payload configuration.
Software Supply Chain Security
The owner-wide expansion documents scale beyond the largest public count found in the reviewed sources, together with rewritten-history and pull-request evidence.
Software Supply Chain Security
The pinned-commit set and decoded host inventory quantify a publicly described pattern; 193 owners also appear in the PolinRider set.
Malware Analysis
The contribution is the pinned-commit count and the separation of published tools from affected project copies.
Software Supply Chain Security
The research identifies the workflow cluster, its signing identity and the shared payout configuration in unrelated developer accounts.
Malware Analysis
The research records hashes, identical archive-entry layouts with different archive hashes, and detection results for the examined set.
Malware Analysis
The research documents the hub-and-spoke structure and separates 12 lures proven by malware-family hashes from 1,422 that only link suspected hubs.
Threat Intelligence
The reviewed analysis records a 15-account farm, the decoded destination and user-agent cloaking logic.
Threat Intelligence
This observed set documents a 2026 use of the template through an own-repository notification path, rather than a broad campaign count.
Threat Intelligence
The method records rejected candidates and an independent second-API recheck instead of treating search results as proof.