A malware distribution campaign named FakeGit is flooding GitHub with more than 7,600 repositories designed to trick developers into infecting their own machines, cybersecurity researchers reported.
The operation works by creating repositories that look like legitimate open-source projects, complete with realistic code and documentation. Developers who clone or download these repositories end up infected with SmartLoader, a well-known malware family used to deliver information stealers and remote access trojans as secondary payloads.
The sheer volume of repositories involved makes this one of the largest documented supply chain attacks against a code hosting platform. The campaign appears to have been active for some time before it was discovered, which raises questions about how effectively GitHub can verify new repository authenticity at scale.
For development teams, the incident highlights the need for caution when integrating third-party code from unverified sources. Security teams should audit recent git clone activity and review any unexpected dependencies that have entered their build pipelines. GitHub has not yet commented on whether it has removed the malicious repositories.
