7,600 repos compromised. Not a GitHub problem.
Per BleepingComputer, the FakeGit campaign has pushed SmartLoader and StealC malware through these repositories, accumulating over 14 million downloads. The Hacker News confirms that nearly 800 of these repositories masquerade as AI skills or Model Context Protocol servers, delivering the SmartLoader malware.
While the incident highlights GitHub's vulnerability, it actually exposes a broader issue of software supply chain risk, with 60% of attacks attributed to third-party involvement in breaches, according to Verizon's DBIR 2025.
The defensive math: -> Implement a repository allowlist to restrict downloads to trusted sources, reducing the attack surface by 90% (CrowdStrike). -> Conduct regular code reviews to detect and remove malicious ZIP files, decreasing the median dwell time by 14 days (Mandiant). -> Enforce Multi-Factor Authentication for all developers, as 88% of Basic Web Application attacks involved stolen credentials (Verizon DBIR 2025).
Can your team detect malicious repositories before they reach your production environment?
https://tomodachi.work/zanshin/