I found 10k GitHub repositories distributing Trojan malware

	I found 10k GitHub repositories distributing Trojan malware(orchidfiles.com)
	824 points by theorchid 1 day ago \| 214 comments
	tl;dr: A developer discovered that someone had cloned his GitHub repo, preserving all commits and contributors, but added a link to a zip archive containing a Trojan in the README. By analyzing GitHub event archives for repos updated frequently with only README changes containing zip links, he identified ~10,000 such malware-distributing repositories—about 25% of repos matching his pattern. GitHub only removed the repos he explicitly reported and has made no effort to detect the pattern themselves, despite the scheme running for over a year.
	HN Discussion: ↑The attack targets AI coding agents that auto-add dependencies, explaining the timing and tactics ↑Personal confirmation: I've experienced the same malware cloning of my repos ↑GitHub broadly ignores malware and abuse reports across many categories, not just this one •Technical analysis identifying the specific trojan family involved in the samples ~Concern about a more sophisticated future threat: LLM training-data poisoning rather than obvious zip links