Older Malware Still Public on GitHub

Not everything found in this research is a live campaign. 273 repositories carry older, publicly documented malware. Most are Discord token stealers or copies of the errorHandler loader from the fake coding tests; one is a Python loader with an encrypted stage.

• 202 repositories (187 accounts) hold Discord token stealers. Each contains a hard-coded Discord webhook address with its token and code that reads Discord's local storage. Most are written in Python.
• 70 repositories (68 accounts) hold an errorHandler-style loader in a controller or bootstrap file. It is the same loader family the Contagious Interview fake job tests use. It sits in copies of those test projects that are not part of the operators' own template set.
• Both families are public. What this page adds is the count at a pinned commit, and the reasons these sets are kept apart.
• On 30 October I removed three research datasets that had matched these rules: one of model outputs and two of collected malware samples. They are kept for study and are not infections.
• On 31 October I added four stealers found by a wider read of lure and tool repositories: a game-cheat DLL source, two copies of one PowerShell grabber and a single-file injector. Later that day my daily searches added 39 more stealers, and a review of the broad-rule matches added one Python loader (see What is not counted).

Nothing was executed. Owners of the loader copies are treated as victims and are not named. Authors of the stealer repositories are not named either.

The proven set was closed on 1 November 2026 with what had been found up to 31 October 2026, 17:59 UTC; repositories found after that are tracked separately and are not in these figures. The full proof pass at pinned commits ran on 30–31 October. On 1 November 2026, 18:23 UTC a read-only GitHub API recheck covered the 162 repositories, 73 accounts and 12 issues that are tracked one by one (operator repositories, Shai-Hulud accounts, phishing issues), not the whole set.

• Frozen: 273 repositories under 256 accounts: 202 Discord token stealers, 70 errorHandler copies and 1 Python loader.
• Nature: published tools and copied loaders, not a campaign; the owners are not treated as victims or as operators.

• 148 of the 202 files are Python. The rest are Java, PowerShell, batch, JavaScript, C#, .pyw, C++, Rust, one .ets file, one executable and files without an extension.
• Many file names call them stealers, grabbers or nukers. That suggests malware published as tools, not infections of someone else's project, although I did not check each repository's history. They are counted, but not as compromised accounts.
• 59 of the first 163 have stars, so people do find and copy them.

These are back-end files of the Node.js projects used as fake coding tests. The loader evaluates a response from a remote address. Contagious Interview describes the family and the operators' own template repositories. The 70 here are separate copies, none of them forks. Where each copy came from was not traced.

A broader first pass also matched these rules:

The same patterns occur in tests, scanners and legitimate installers. On 31 October I reviewed all 180 with stricter rules fixed before reading. One counts: a Python loader that decrypts a Fernet-encrypted stage. Decrypted statically with the key in the file, the stage downloads and runs code from easylogs[.]fun. It is in the total. The other 179 are tests, scanners, research samples and legitimate installers, and stay out.

1. Never run a "grabber", "nuker" or "token checker" from GitHub. These tools steal from whoever runs them.
2. In Node.js back ends, look for Function.constructor, new Function( or eval( applied to an HTTP response, in controllers, bootstrap files and error handlers.
3. If you received a coding test as a repository, read Contagious Interview before running it.

• The stealer rule is a code pattern. It does not tell an educational repository from a working one, so some of the 202 may never have worked.
• The loader copies were not traced back to the test they came from.
• The 180 broad-rule repositories were reviewed on 31 October from the matched files; only one was counted.

This article is part of the GitHub threat investigation. Counts are a snapshot, not evidence that the code ran on a victim's machine. The shared methodology and proof rules explain inclusion, exclusions and the independent re-check.