GitHub 3 Weeks Is Not Remove Malware

The center of the software development community appeared in a serious security issue on GitHub. The imitation versions of popular libraries created by malicious actors are not yet removed on the platform. This situation leaves thousands of advanced attacks against potential attacks.

The main points of the problem can be summarized as follows:

• Harmful software is used to mislead developers to names of legitimate packages
• It is reported that no action is taken by GitHub, despite passing 3 weeks since the first ihbar date
• Taklit packages can run code that can be controlled on the system after downloading and installed
• Such attacks on open source ecosystem seriously threatens supply chain security

Security response on central platforms like GitHub is very important. If the harmful packages remain there for a long time, the more developers and projects face the risk of influence. This delay can damage the trust of companies and individual developer community working with open source projects.

Event has shown the necessity of improving the moderation and threat response systems of platforms once again. Developers should continue to carefully check the package resources and signatures while downloading dependency.