AI is changing the world. Don't stay behind. Clear summaries, community insight, delivered without the noise. Subscribe to never miss a beat.

What does GitHub's security team even do?

orchidfiles.com

July 26, 2026

4 min read

🔥🔥🔥🔥🔥

48/100

Summary

Thousands of repositories on GitHub are currently distributing malware, accessible through the standard search function without special knowledge. Despite having a substantial budget, a dedicated security team, and AI resources, GitHub has not resolved this issue over the past two years.

Key Takeaways

Thousands of repositories on GitHub are distributing malware, identifiable through standard search functions on the platform.
GitHub's security team deleted 10,000 malicious repositories identified by a script but did not implement further preventive measures.
The structure of the malicious repositories is similar, often containing headings with emojis and links to zip archives with Trojans.
A specific search query can be used to find repositories with links to zip archives containing malware, demonstrating a pattern that could be exploited for further identification.

Read original article

Community Sentiment

Negative

Positives

Improvements to GitHub Actions security show that pressure can lead to real change, though it feels like we need more pain first.
Some commenters see potential for package managers like PyPi to take a stand against insecure projects, which could force GitHub to step up its game.
The discussion hints at a need for stronger incentives for security teams, like tying executive bonuses to security performance.

Concerns

GitHub's response time to malicious repositories is often lackluster, pointing to a resource starvation issue rather than incompetence.
The sentiment that Microsoft may want to slowly kill the GitHub brand raises serious concerns about the platform's future and commitment to security.
Security is viewed as a cost-center, leading to a lack of investment until incidents start impacting revenue — this is a dangerous mindset.