10,000 GitHub repositories distributed Trojan malware: the finding that alerts the open source community
A security researcher known as Orchid has uncovered one of the largest malware distribution campaigns in GitHub’s history. In an article published on June 18, 2026, the researcher recounts how he discovered more than 10,000 active repositories harboring trojans disguised in ZIP files. The repositories —which are not forks and share no apparent author— all follow the same pattern: they are cloned from legitimate projects, a link to a compressed file containing the malware is added to the README, and every few hours the previous commit is removed and a new one with the same content is uploaded, a tactic designed to evade automated detection.
The operating mechanism is as simple as it is effective. The attackers clone existing repositories, modify only the README.md file to include a link to a ZIP containing a trojan, and update the commit periodically to avoid raising suspicion. The researcher managed to identify the pattern thanks to the analysis of GitHub public events: of the 16 million push commits recorded in the last five days, some 40,000 frequent updates followed this behavior, and of those, 10,000 matched the malware profile exactly. When uploading the ZIP link to VirusTotal, the result was clean; but when scanning the compressed file itself, the trojan was detected unambiguously. Some of these repositories had been active for more than a year without GitHub automatically removing them.
The case has reopened the debate on moderation on open source platforms. Despite the researcher having reported the first repositories months ago, GitHub took weeks to respond and remove them. Orchid has published the complete list of malicious repositories and recommends that developers be extremely cautious when running code or downloading files from little-known repositories. Meanwhile, the community hopes that GitHub will take stronger measures to curb this new wave of trojans that exploit the trust inherent in the open source ecosystem.
— Marta, for intermittent intelligence.
