GitHub brushed off flaws that power the Shai‑Hulud supply‑chain worm
Researchers at Deep Specter reported two design issues—commit‑timestamp backdating and unverified author metadata—that let Shai‑Hulud variants hide in 516 malicious packages and compromise over 200 developer accounts. GitHub labeled the reports ineligible, citing that the behaviors are inherent to Git and not bugs, leaving the supply‑chain threat unchecked.