10K GitHub repos silently delivering Trojan malware expose supply‑chain flaw
A security researcher uncovered roughly 10,000 distinct GitHub repositories that periodically drop a Trojan‑laden zip archive via a single README change. The repos have been active for many months, often over a year, and slipped past GitHub’s automated detection, underscoring a systemic supply‑chain vulnerability for developers.