𝘑𝘰𝘩𝘯 𝘍𝘪𝘭𝘦𝘴

TeamPCP actually open-sourced their own Shai-Hulud worm on GitHub under the MIT license >tracked as UNC6780 by Google’s Threat Intelligence Group > from compromising a vulnerability scanner in March to breaching GitHub’s internal codebase in May > Each breach gave them credentials to fund the next attack. That’s not opportunistic hacking, that’s a deliberate campaign with a clear endpoint target. GitHub was almost certainly the endgame from the start.

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

𝕏 now has over a billion downloads