What does GitHub's security team even do?
orchidfiles.com
July 26, 2026
4 min read
51/100
Summary
Thousands of repositories on GitHub are currently distributing malware, accessible through the standard search function without special knowledge. Despite having a substantial budget, a dedicated security team, and AI resources, GitHub has not resolved this issue over the past two years.
Key Takeaways
- Thousands of repositories on GitHub are distributing malware, identifiable through standard search functions on the platform.
- GitHub's security team deleted 10,000 malicious repositories identified by a script but did not implement further preventive measures.
- The structure of the malicious repositories is similar, often containing headings with emojis and links to zip archives with Trojans.
- A specific search query can be used to find repositories with links to zip archives containing malware, demonstrating a pattern that could be exploited for further identification.
Coverage & discussions
Hacker News · orchidfiles.com
Community discussions
Community Sentiment
Positives
- Improvements to GitHub Actions security show that pressure can lead to real change, though it feels like we need more pain first.
- Some commenters see potential for package managers like PyPi to take a stand against insecure projects, which could force GitHub to step up its game.
- The discussion hints at a need for stronger incentives for security teams, like tying executive bonuses to security performance.
Concerns
- GitHub's response time to malicious repositories is often lackluster, pointing to a resource starvation issue rather than incompetence.
- The sentiment that Microsoft may want to slowly kill the GitHub brand raises serious concerns about the platform's future and commitment to security.
- Security is viewed as a cost-center, leading to a lack of investment until incidents start impacting revenue — this is a dangerous mindset.
Related Articles
I found 10k GitHub repositories distributing Trojan malware
Jun 18, 2026
Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Repositories
Mar 15, 2026
Microsoft's stance on zero day exploits is a dumpster fire of their own making
May 28, 2026
Restructuring GitHub's bug bounty program
Jul 23, 2026
Anatomy of a Failed (Nation-State?) Attack
Jun 27, 2026