https://cmpc.ro/Independent cybersecurity researchenMon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/github-threat-investigation-2026/https://cmpc.ro/publications/github-threat-investigation-2026/Static analysis of public GitHub repositories proved 43,448 GitHub repositories linked to malicious activity under 4,250 accounts across nine activities, from PolinRider to Contagious Interview.Mon, 02 Nov 2026 00:00:00 GMTgithubsupply-chainmalwarepolinridercontagious-interviewthreat-intelligencehttps://cmpc.ro/publications/contagious-interview-fake-coding-tests/https://cmpc.ro/publications/contagious-interview-fake-coding-tests/Fake coding assessments contain loaders and repository-controlled hooks that can execute code during normal developer actions.Mon, 02 Nov 2026 00:00:00 GMTcontagious-interviewdprkfake-job-interviewgit-hooksvs-code-tasksmalwarehttps://cmpc.ro/publications/contagious-interview-servers-infrastructure/https://cmpc.ro/publications/contagious-interview-servers-infrastructure/Public repositories contain staging and payload server source, alongside a related JavaScript stealer family.Mon, 02 Nov 2026 00:00:00 GMTcontagious-interviewdprkinfrastructuregithubthreat-intelligencehttps://cmpc.ro/publications/polinrider-github-supply-chain-loader/https://cmpc.ro/publications/polinrider-github-supply-chain-loader/PolinRider loaders are present in 40,136 public repositories at pinned default-branch commits.Mon, 02 Nov 2026 00:00:00 GMTpolinriderdprkgithubvs-code-taskssupply-chainmalwarehttps://cmpc.ro/publications/auth-api-key-loader-github/https://cmpc.ro/publications/auth-api-key-loader-github/Server and build files decode an environment variable and pass code to eval or Function.Mon, 02 Nov 2026 00:00:00 GMTgithubloadernodejssupply-chainmalwarehttps://cmpc.ro/publications/older-malware-still-on-github/https://cmpc.ro/publications/older-malware-still-on-github/Two known malware families remain in public code: Discord token stealers and copied errorHandler loaders.Mon, 02 Nov 2026 00:00:00 GMTgithubmalwarediscord-token-stealerloaderhttps://cmpc.ro/publications/d1337-github-actions-cryptomining/https://cmpc.ro/publications/d1337-github-actions-cryptomining/A GitHub Actions workflow is configured to download XMRig and mine to one payout wallet.Mon, 02 Nov 2026 00:00:00 GMTgithub-actionscryptominingxmrigci-cdsupply-chainhttps://cmpc.ro/publications/smartloader-fake-cve-exploits/https://cmpc.ro/publications/smartloader-fake-cve-exploits/Repositories presented as CVE proofs of concept distribute archives with launcher-and-interpreter layouts instead of exploits.Mon, 02 Nov 2026 00:00:00 GMTsmartloaderfake-exploitgithubluainfostealerhttps://cmpc.ro/publications/cheat-crack-lure-repositories/https://cmpc.ro/publications/cheat-crack-lure-repositories/README lures point to rotating download hubs with unusually large, padded archives.Mon, 02 Nov 2026 00:00:00 GMTgithubgame-cheatscracksinfostealerlureshttps://cmpc.ro/publications/trading-bot-lure-farm/https://cmpc.ro/publications/trading-bot-lure-farm/Trading-tool landing pages assemble a hidden download destination and withhold it from scanners.Mon, 02 Nov 2026 00:00:00 GMTgithubgithub-pagescryptolurescloakinghttps://cmpc.ro/publications/fake-github-security-alert-issues/https://cmpc.ro/publications/fake-github-security-alert-issues/Issues in a sender-controlled repository impersonate GitHub security alerts and mention one target each.Mon, 02 Nov 2026 00:00:00 GMTgithubphishingoauthlureshttps://cmpc.ro/publications/github-threat-investigation-methodology/https://cmpc.ro/publications/github-threat-investigation-methodology/The headline count is built from fixed inclusion rules and pinned repository states, with a metadata-only exception for Shai-Hulud.Mon, 02 Nov 2026 00:00:00 GMTmethodologygithubmalwaredetection-engineeringthreat-intelligence