Series · 12 articles
GitHub threat investigation, 2026
Starting from one antivirus alert, which malicious activities sit in public GitHub repositories, and how many repositories can be proven file by file, at a fixed commit, under a rule decided before the count?
How the parts relate
The investigation started with fake job-interview coding tests (Contagious Interview). PolinRider, a publicly known supply-chain loader, was found inside that campaign's repositories and is most of the proven total.
Each activity has its own article with its full analysis, evidence register, indicators where available, and limitations. One shared methodology page gives the inclusion rules, the counting rules and the independent re-check.
The activities are not attributed to a single operator. Two loaders share victims: 193 of the 379 accounts with the AUTH_API_KEY loader also own a proven PolinRider repository. That shows shared victims, not shared operators.
Start here
01 · Threat Intelligence
From a Defender Alert to 43,448 GitHub Repositories Linked to Malicious Activity
Static analysis of public GitHub repositories proved 43,448 GitHub repositories linked to malicious activity under 4,250 accounts across nine activities, from PolinRider to Contagious Interview.
02 · Software Supply Chain Security
PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories
The owner-wide expansion documents scale beyond the largest public count found in the reviewed sources, together with rewritten-history and pull-request evidence.
03 · Threat Intelligence
How the GitHub Investigation Was Verified
The method records rejected candidates and an independent second-API recheck instead of treating search results as proof.
Reading paths
The largest finding first
PolinRider's scale and proof, then the rules every count follows.
In the order it was found
From the alert and the fake coding tests to the servers behind them and the loader found inside their repositories.
For defenders
Pages with detection rules, indicators and defensive checks.
All published parts
- 01From a Defender Alert to 43,448 GitHub Repositories Linked to Malicious Activity
Threat Intelligence · 7 min
- 02Contagious Interview: Fake Coding Tests and Execution Triggers
Malware Analysis · 12 min
- 03Contagious Interview: Public Servers, Infrastructure and Payloads
Threat Intelligence · 30 min
- 04PolinRider: A Supply-Chain Loader in 40,136 GitHub Repositories
Software Supply Chain Security · 21 min
- 05The AUTH_API_KEY Loader in 649 GitHub Repositories
Software Supply Chain Security · 6 min
- 06Older Malware Still Public on GitHub
Malware Analysis · 2 min
- 07D1337: Cryptomining in Other People's GitHub Actions
Software Supply Chain Security · 5 min
- 08Fake CVE Exploits Delivering SmartLoader
Malware Analysis · 6 min
- 09Cheat and Crack Lures on GitHub
Malware Analysis · 10 min
- 10Trading-Bot Pages with Hidden Download Links
Threat Intelligence · 6 min
- 11Fake GitHub Security Alerts Delivered Through Issues
Threat Intelligence · 4 min
- 12How the GitHub Investigation Was Verified
Threat Intelligence · 16 min