GitHub Dismissed Security Reports on Flaws Now Exploited by Supply-Chain Worm, Researchers Say

Why It Matters

The dismissal exposes a gap between GitHub’s bug‑bounty scope and real‑world supply‑chain threats, leaving millions of developers exposed to credential theft and malicious code. It also pressures the platform to rethink visibility of commit provenance and size‑based scanning limits.

Key Takeaways

• GitHub closed two Deep Specter vulnerability reports as ineligible.
• Worm exploits commit timestamp backdating and forged author metadata.
• Over 516 malicious packages live across npm, PyPI, RubyGems.
• 151 active malicious repositories still host the 4.6 MB payload.
• GitHub’s code‑search size limit hides large malicious files from scans.

Pulse Analysis

The Shai‑Hulud worm, first traced to the TeamPCP cybercrime group, has evolved into a supply‑chain menace that targets the open‑source ecosystem. By publishing a 4.6 MB obfuscated payload and creating throwaway repositories, the malware can hijack package managers such as npm, PyPI and RubyGems, injecting malicious code into thousands of downstream projects. Recent breaches at the European Commission, AI‑recruiting firm Mercor, the LiteLLM library, and even GitHub itself illustrate how quickly the worm spreads, compromising over 200 developer accounts and threatening the integrity of critical software pipelines.

Deep Specter’s two reports highlighted two design choices that the worm exploits: commit timestamps that can be back‑dated, and author metadata that can be arbitrarily set. These features allow attackers to make fresh malicious commits appear as historic, routine changes, evading tools that flag recent activity. Moreover, GitHub’s code‑search engine skips files larger than a few megabytes, rendering the primary payload invisible to automated scanners. When the researchers raised these concerns, GitHub classified them as out‑of‑scope, citing that the underlying Git protocol, not the platform, permits such metadata.

The episode underscores a broader tension between open‑source convenience and supply‑chain security. Platforms that host billions of lines of code must balance Git’s flexibility with safeguards that surface anomalous behavior, such as exposing the true pusher’s identity beyond the 90‑day API window or indexing larger binaries. As Microsoft rolls out its largest Patch Tuesday in history, the industry is watching how major custodians respond to disclosure fatigue and researcher frustration. Strengthening bounty eligibility, enhancing code‑search coverage, and mandating commit signing could close the gaps the worm currently exploits.