My GitHub account @icflorescu has been suspended for 3 days, while a worm's payload sits live in 5 of my public repos. The same worm (Miasma) hit 73 Microsoft repos; GitHub disabled those in 105 seconds. Mine are still up. @GitHub, help? Write-up: https://t.co/YGUFlWHxGl
New credentials attack on Google, it's a subtle one. The email actually comes from https://t.co/qmUt6syHRr. It informs you that your recovery contact (an email you don't recognize) is about to reset your password and prompts you to take action. There's a link that appears to point to https://t.co/pOKO2bTLeC but uses the continue URL parameter to redirect you to https://t.co/Ncvbz3poTV, which hosts the attacker's site. If you scroll down, you can see the bottom of the email, which just shows that someone is asking to add you as their recovery contact. The entire first part of the email is a user-controlled field in Google's system that the attacker controlled to include the malicious link and text.
If you maintain repos on GitHub, please check them. The Shai-Hulud worm is still live in many, days after it went public. How to tell if you were hit, how to clean up, and what to do if you're locked out. And no, it's not your fault.
https://t.co/XeGmilRTmy
#miasma#github
It's over, for now. After 4 days locked out, my GitHub account is back and every repo is clean.
The forensics confirmed it: a gh CLI token from January somehow survived, was quietly stolen and reused months later.
Some questions are still open.
https://t.co/2H18tWo77w
‼️🚨 BREAKING: Miasma, a self-propagating supply-chain worm built on the Shai-Hulud and Hades lineage, is now open source. It follows the recent open-sourcing of Shai-Hulud and is already spawning copycats. Attackers now have ready-made worm code in hand.
Submit High / Crit to HackerOne
Analysts move at pace of molasses.
Program company gets breached (unrelated) weeks later.
Issue fixed during response.
Report finally closed as informative because it was never escalated.
Why even bother?
For what it’s worth, here’s proof GitHub has known about this for since at least Sept 2025. Longer based on the original report. how many GitHub customers were impacted by the worm with this?
M$ needs to fund GitHub security and dev teams so they can actually fix bugs.
Earlier today I lost access to my forked repo for azure-function-core-tools where I've contributed and Github told me it was due to a violation of GitHub's terms of service.
I went to the main repo and it says the same.
https://t.co/P5cqb6FR4f
Now we have this post.
https://t.co/yaFK9R3MmP
From his wife. He lost access to his Github account.
The repos with the malicious code are still live.
https://t.co/Nv6NnFMntY
His own LinkedIn post.
https://t.co/Kocs7VjkBm
The concerning part of the post:
"We have checked our own environments thoroughly and found no traces of compromise. We suspect this may be part of the broader GitHub infrastructure breach carried out by the TeamPCP hacking group in May 2026"
@adnanthekhan@ThePrimeagen@theo Already tried that myself, but my voice is not big enough to reach that someone with a bigger microphone. And tbh, I'm so goddamn tired and frustrated by whole this that I'm seriously considering quitting writing open-source.
@adnanthekhan@github Thanks Adnan. I'm the maintainer, still suspended. Same worm hit 73 Microsoft repos; GitHub disabled those in 105 seconds, mine are still live 3 days later. The commit is forged/unsigned, not a real bot, and detonates via AI-IDE config. Full teardown: https://t.co/YGUFlWHxGl