Threat actors are distributing credential-stealing malware through hundreds of fake software repositories on GitHub, npm, PyPI, and Hugging Face, impersonating legitimate developers, security vendors, and AI services. Arctic Wolf researchers documented at least 292 malicious GitHub repositories distributing the BoryptGrab infostealer since June 2026, part of a larger campaign affecting nearly 2,000 repositories across package ecosystems.
The attack exploits developer trust in open-source repositories. Marketing-styled README files and professional-looking documentation conceal malicious download links that route to fake "secure download" pages. Once executed, the malware steals browser credentials, cryptocurrency wallet data, API tokens, and SSH keys—granting attackers access to GitHub, npm, AWS, and cloud infrastructure.
Table of Contents
- Scale of the campaign
- What the malware steals
- Who is targeted
- How attackers evade detection
- Steps to reduce risk
Scale of the campaign
The scope extends far beyond a single threat actor. Arctic Wolf identified 292+ deceptive GitHub repositories masquerading as security tools, development libraries, and AI services. Upwind security researchers documented 1,948 public GitHub repositories showing signs of attacker activity as of May 2026, with hundreds of malicious packages targeting npm and PyPI.
High-profile projects have been compromised. A fake OpenAI Privacy Filter model reached #1 trending on Hugging Face in May 2026, accumulating 244,000 downloads in under 18 hours before detection. Earlier campaigns included OpenClaw GhostSocks repositories posing as legitimate installers, available for nine days in February 2026, and typosquat attacks on CI/CD tools targeting GitHub Actions workflows.
What the malware steals
The BoryptGrab infostealer recovered from fake repositories is comprehensive in scope. The malware includes targets for 19 web browsers and 41 cryptocurrency wallet applications, extracting saved passwords, session cookies, private keys, and wallet seed phrases. A single successful infection provides attackers with credentials to multiple critical systems.
Additional malware variants expand the attack surface. Fake OpenAI models inject loaders that steal credentials for Chromium, Firefox, Discord, cryptocurrency wallets, and FileZilla configurations. One self-propagating npm worm (TeamPCP) captures npm tokens, GitHub tokens, AWS credentials, and Kubernetes access simultaneously, then uses stolen npm credentials to hijack and republish victim packages with injected malicious code.
Who is targeted
Developers remain the primary target because they execute untrusted code during routine dependency installation. Attackers specifically target junior security researchers and students by creating fake GitHub repositories offering proof-of-concept exploits for high-profile CVEs—code that researchers actively seek for legitimate study. Fake repositories are designed to appear credible through professional documentation, realistic commit histories, and familiar branding.
The attack compromises entire infrastructure chains. Once malware executes on a developer workstation, CI/CD pipeline, or cloud environment, stolen credentials enable lateral movement through GitHub organizations, npm registries, AWS accounts, Azure subscriptions, and Kubernetes clusters. A single compromised dependency can grant attackers access to production systems serving millions of users.
How attackers evade detection
Malware developers employ sophisticated evasion techniques to delay discovery and takedown. Detection-evasion code includes VM and sandbox detection, Windows security disabling, and stealth packers designed to frustrate malware analysis. Fake repositories carefully craft commits, documentation, and activity patterns to avoid automated flagging by platform security systems.
Typosquatting and social engineering compound the problem. Attackers register packages with names nearly identical to legitimate ones—like "@acitons/artifact" instead of "@actions/artifact"—exploiting human reading speed and automated dependency resolvers. These packages remain undetected longer because developers may not carefully verify exact spelling during routine dependency audits.
Steps to reduce risk
Developers and organizations should implement checks at multiple stages of the supply chain: Attackers exploit developer convenience and trust. Legitimate software repositories have security practices, but no platform can catch every malicious upload before download. Individual diligence remains essential.
- Verify exact package names and authors during dependency installation; typos are common attack vectors.
- Use lockfiles (package-lock.json, yarn.lock, Pipfile.lock) and pin versions to prevent unexpected updates to malicious newer versions.
- Monitor npm and PyPI audit alerts, and enable two-factor authentication on npm and GitHub accounts to prevent credential-based hijacking.
- Review the source code and commit history of unfamiliar packages before installation, especially security-focused or infrastructure tools.
- Run CI/CD pipelines with minimal credential scope; separate authentication tokens for development, staging, and production systems.