Ionut-Cristian Florescu

TypeScript, JS, React & Node.js geek. Creator of Mantine DataTable, PocketBaseUML & other OSS. Love freedom, cats, nature walks. Hate hypocrisy & xenophobia.

[Ionut-Cristian Florescu @icflorescu]

My GitHub account @icflorescu has been suspended for 3 days, while a worm's payload sits live in 5 of my public repos. The same worm (Miasma) hit 73 Microsoft repos; GitHub disabled those in 105 seconds. Mine are still up. @GitHub, help? Write-up: https://t.co/YGUFlWHxGl

[Arthur B. @ArthurB]

New credentials attack on Google, it's a subtle one. The email actually comes from https://t.co/qmUt6syHRr. It informs you that your recovery contact (an email you don't recognize) is about to reset your password and prompts you to take action. There's a link that appears to point to https://t.co/pOKO2bTLeC but uses the continue URL parameter to redirect you to https://t.co/Ncvbz3poTV, which hosts the attacker's site. If you scroll down, you can see the bottom of the email, which just shows that someone is asking to add you as their recovery contact. The entire first part of the email is a user-controlled field in Google's system that the attacker controlled to include the malicious link and text.

[Ionut-Cristian Florescu @icflorescu]

If you maintain repos on GitHub, please check them. The Shai-Hulud worm is still live in many, days after it went public. How to tell if you were hit, how to clean up, and what to do if you're locked out. And no, it's not your fault.
https://t.co/XeGmilRTmy

#miasma #github

[Ionut-Cristian Florescu @icflorescu]

It's over, for now. After 4 days locked out, my GitHub account is back and every repo is clean.

The forensics confirmed it: a gh CLI token from January somehow survived, was quietly stolen and reused months later.

Some questions are still open.
https://t.co/2H18tWo77w

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: Miasma, a self-propagating supply-chain worm built on the Shai-Hulud and Hades lineage, is now open source. It follows the recent open-sourcing of Shai-Hulud and is already spawning copycats. Attackers now have ready-made worm code in hand.

[Adnan Khan @adnanthekhan]

Submit High / Crit to HackerOne

Analysts move at pace of molasses.

Program company gets breached (unrelated) weeks later.

Issue fixed during response.

Report finally closed as informative because it was never escalated.

Why even bother?

[Adnan Khan @adnanthekhan]

For what it’s worth, here’s proof GitHub has known about this for since at least Sept 2025. Longer based on the original report. how many GitHub customers were impacted by the worm with this?

M$ needs to fund GitHub security and dev teams so they can actually fix bugs.

[red @redanthrax]

Earlier today I lost access to my forked repo for azure-function-core-tools where I've contributed and Github told me it was due to a violation of GitHub's terms of service.
I went to the main repo and it says the same.
https://t.co/P5cqb6FR4f

Now we have this post.
https://t.co/yaFK9R3MmP

From his wife. He lost access to his Github account.
The repos with the malicious code are still live.
https://t.co/Nv6NnFMntY

His own LinkedIn post.
https://t.co/Kocs7VjkBm

The concerning part of the post:
"We have checked our own environments thoroughly and found no traces of compromise. We suspect this may be part of the broader GitHub infrastructure breach carried out by the TeamPCP hacking group in May 2026"

[Ionut-Cristian Florescu @icflorescu]

@adnanthekhan @ThePrimeagen @theo Already tried that myself, but my voice is not big enough to reach that someone with a bigger microphone. And tbh, I'm so goddamn tired and frustrated by whole this that I'm seriously considering quitting writing open-source.

[Ionut-Cristian Florescu @icflorescu]

@adnanthekhan @github Thanks Adnan. I'm the maintainer, still suspended. Same worm hit 73 Microsoft repos; GitHub disabled those in 105 seconds, mine are still live 3 days later. The commit is forged/unsigned, not a real bot, and detonates via AI-IDE config. Full teardown: https://t.co/YGUFlWHxGl

[Ionut-Cristian Florescu @icflorescu]

@theo so, symlinking is a bad idea, huh?

[Ionut-Cristian Florescu @icflorescu]

The Bot That Never Was
https://t.co/SHMWmW2u3A
@github @Microsoft @Azure

[Ionut-Cristian Florescu @icflorescu]

Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack https://t.co/pSS7VHKrVq via @TheHackersNews

[Ionut-Cristian Florescu @icflorescu]

@dev_maims Why would you get one? AFAIK, there's still no way to install a decent Arch Linux distro on one of those...

[Ionut-Cristian Florescu @icflorescu]

@justbyte_ you don't have the burden ow owning stuff

[Ionut-Cristian Florescu @icflorescu]

@justbyte_

[Ionut-Cristian Florescu @icflorescu]

@starter_story if the coffee shop was on bridge of the titanic, yes, you can

[Ionut-Cristian Florescu @icflorescu]

@zeeg most people don't even know serverless means many servers

[Ionut-Cristian Florescu @icflorescu]

@vikrambuilds An unpopular opinion gaining traction lately.

[Ionut-Cristian Florescu @icflorescu]

@icanvardar us exceptionalists would say otherwise