GitHub Dismissed Security Reports on Flaws Now Exploited by Shai-Hulud Supply-Chain Worm

GitHub rejected two formal vulnerability reports identifying design flaws that researchers say are enabling variants of the Shai-Hulud supply-chain worm to infect and compromise hundreds of software packages and developer accounts worldwide. The reports, submitted by threat intelligence group Deep Specter Research through GitHub’s bug disclosure channel on HackerOne, were both closed as ineligible and not presenting a security risk, despite the ongoing threat posed by the worm.

Although the hacking tool originated with the TeamPCP cybercrime group, copycat entities have emerged using slightly different versions since the original code was published in early May. Over the last few months, these variants have been linked to breaches at the European Commission, AI recruiting firm Mercor, the LiteLLM package, GitHub itself, and Red Hat. Deep Specter told Recorded Future News that its investigation, conducted using only public data, confirmed 516 malicious packages were currently live across five ecosystems including npm, PyPI, and RubyGems, with more than 3,000 affected GitHub repositories and over 200 compromised developer accounts.

The figures were described as a floor by Deep Specter, which noted in a technical report that GitHub's code search does not index files above a certain size threshold, rendering the worm's primary payload — a roughly 4.6 MB obfuscated file — invisible to automated scanning. The company said its first report to GitHub concerned how GitHub handles commit timestamps, allowing whoever pushes the code the freedom to backdate when they added it to a repository. Deep Specter said the worm uses this feature to make recently added malicious changes appear like routine edits from years earlier, evading defenses that look in a repository's history for recent suspicious activity.

GitHub told the researchers that commit timestamps are client-supplied metadata by design and that the underlying security issue was the compromised credentials used to push the code, not the timestamp. Deep Specter’s second report concerned who was identified as the author of these commits. GitHub displays the name, photo, and username of the authors as if they were confirmed, but in practice the fields are freely set by the attacker and never verified. The worm uses this to make malicious commits appear to have been made by trusted engineers who never touched the code.

GitHub told researchers that arbitrary author metadata is a property of the git version control system, not a GitHub vulnerability, and that its bug bounty program documentation explicitly lists commit author impersonation as a known ineligible finding. The company pointed Deep Specter to GPG and SSH commit signing and its opt-in Vigilant Mode as available mitigations. The developers whose identities were forged in the Shai-Hulud campaign had not enabled those controls.

GitHub does record which account actually pushed each commit — data that cannot be forged — in its Events API, but does not display it on the commit page visible to reviewers. That record expires from public view after approximately 90 days. Deep Specter raised the security value of improving the visibility of these records, but GitHub described that as a feature request rather than a security fix. As of June 16, Deep Specter said 1,729 throwaway repositories created by the worm to store stolen credentials remained live on GitHub, alongside 151 repositories still serving active malicious payloads — figures the company described as a snapshot of public data on that date.

The dismissals come amid broader criticism of Microsoft and GitHub's disclosure policies. Researchers have repeatedly complained that the company has unjustly dismissed their vulnerability reports, and under the Biden administration, Microsoft was described as presiding over a cascade of security failures allowing hackers to break into government systems. Another researcher recently published a separate GitHub token-stealing exploit targeting Microsoft repositories in the same period, underscoring the breadth of credential-theft activity targeting the platform. Neither GitHub nor its parent company Microsoft responded to requests for comment.