https://cmpc.ro/New publications, revisions and updates after publicationenMon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/github-threat-investigation-2026/github-threat-investigation-2026:2026-11-02:Published: From a Defender Alert to 43,448 GitHub Repositories Linked to Malicious ActivityStatic analysis of public GitHub repositories proved 43,448 GitHub repositories linked to malicious activity under 4,250 accounts across nine activities, from PolinRider to Contagious Interview.Mon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/contagious-interview-fake-coding-tests/contagious-interview-fake-coding-tests:2026-11-02:Published: Contagious Interview: Fake Coding Tests and Execution TriggersFake coding assessments contain loaders and repository-controlled hooks that can execute code during normal developer actions.Mon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/contagious-interview-servers-infrastructure/contagious-interview-servers-infrastructure:2026-11-02:Published: Contagious Interview: Public Servers, Infrastructure and PayloadsPublic repositories contain staging and payload server source, alongside a related JavaScript stealer family.Mon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/polinrider-github-supply-chain-loader/polinrider-github-supply-chain-loader:2026-11-02:Published: PolinRider: A Supply-Chain Loader in 40,136 GitHub RepositoriesPolinRider loaders are present in 40,136 public repositories at pinned default-branch commits.Mon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/auth-api-key-loader-github/auth-api-key-loader-github:2026-11-02:Published: The AUTH_API_KEY Loader in 649 GitHub RepositoriesServer and build files decode an environment variable and pass code to eval or Function.Mon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/older-malware-still-on-github/older-malware-still-on-github:2026-11-02:Published: Older Malware Still Public on GitHubTwo known malware families remain in public code: Discord token stealers and copied errorHandler loaders.Mon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/d1337-github-actions-cryptomining/d1337-github-actions-cryptomining:2026-11-02:Published: D1337: Cryptomining in Other People's GitHub ActionsA GitHub Actions workflow is configured to download XMRig and mine to one payout wallet.Mon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/smartloader-fake-cve-exploits/smartloader-fake-cve-exploits:2026-11-02:Published: Fake CVE Exploits Delivering SmartLoaderRepositories presented as CVE proofs of concept distribute archives with launcher-and-interpreter layouts instead of exploits.Mon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/cheat-crack-lure-repositories/cheat-crack-lure-repositories:2026-11-02:Published: Cheat and Crack Lures on GitHubREADME lures point to rotating download hubs with unusually large, padded archives.Mon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/trading-bot-lure-farm/trading-bot-lure-farm:2026-11-02:Published: Trading-Bot Pages with Hidden Download LinksTrading-tool landing pages assemble a hidden download destination and withhold it from scanners.Mon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/fake-github-security-alert-issues/fake-github-security-alert-issues:2026-11-02:Published: Fake GitHub Security Alerts Delivered Through IssuesIssues in a sender-controlled repository impersonate GitHub security alerts and mention one target each.Mon, 02 Nov 2026 00:00:00 GMThttps://cmpc.ro/publications/github-threat-investigation-methodology/github-threat-investigation-methodology:2026-11-02:Published: How the GitHub Investigation Was VerifiedThe headline count is built from fixed inclusion rules and pinned repository states, with a metadata-only exception for Shai-Hulud.Mon, 02 Nov 2026 00:00:00 GMT