42 GitHub Repositories Compromised via Large Payloads

• •42 GitHub repositories compromised using large payloads to avoid detection.
• •Attackers deployed polymorphic wrappers and a native addon to conceal malicious payloads.
• •The attack is linked to previous exploitation of GitHub Actions and npm ecosystem vulnerabilities.

JFrog Security Research reported breaches of 42 third-party GitHub repositories, where attackers deployed large payload blobs to evade detection. The compromised repositories contained execution hooks for AI coding assistants and IDEs, with polymorphic wrappers up to 13.7MB that decoded to a hidden CI-publisher payload. The attackers used a compiled native addon that decrypts a file named .napi_cache at runtime to reveal the actual payload. Investigations revealed account hijacks, forged commit timelines, and exposed npm credentials. The attack is linked to previously reported GitHub Actions exploitation of internet-facing cPanel systems. The npm ecosystem was alerted to the presence of malicious packages named shai-hulud, with SafeDep documenting the npm/package side of the activity. The malicious releases aimed to steal GitHub and npm credentials, potentially compromising third-party repositories. The situation is ongoing, with further analysis required to fully understand the scope and impact.