---
title: "GitHub has a malware problem"
url: https://daily.dev/posts/github-has-a-malware-problem-uhdki0gty
source_url: https://www.youtube.com/watch?v=w2ID4YLbzMo
type: video:youtube
source: "Coding with Lewis"
published: 2026-04-08T17:45:27.799Z
updated: 2026-04-08T17:45:44.975Z
tags: ["security", "python", "open-source", "github", "malware"]
reading_time: 1
upvotes: 107
comments: 14
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub has a malware problem

**[Coding with Lewis](https://daily.dev/sources/codingwithlewis)** · 1 min read · 107 upvotes · 14 comments

## Summary

GitHub's trending page is being exploited by attackers who create repositories with legitimate-sounding names and purchase fake stars to lure developers into downloading malware. Researchers built Star Scout, which scanned six years of GitHub metadata and identified over 6 million suspicious fake stars by detecting ghost accounts and coordinated starring clusters. One group called Banana Squad published nearly 70 repos mimicking real Python security tools, hiding malicious code by padding it with hundreds of blank spaces to push it off-screen. A separate campaign compromised a single GitHub Action and put over 23,000 repositories at risk. The open source ecosystem's trust model is being systematically exploited at scale.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.youtube.com/watch?v=w2ID4YLbzMo>

## Community discussion

Top comments from developers on daily.dev.

**@musikk** · 16 upvotes

> I'm safe, I never look at GitHub's trending page.

**@threenine** · 7 upvotes

> Some would say, since M$ took over github it has become malware

**@mendibox** · 4 upvotes

> I'm really surprised how threats are literally everywhere.

**@dhugo** · 3 upvotes

> Because you don't look at the trending page doesn't mean the repos you pull are safe.
>
> A recent example is the well-known NPM React dependency Axios malware (see this post) when that broadly used NPM repo got a fraudulent version pushed by an attacker, contaminating millions of users by simple npm run install / update updating their dependencies, or rebuilding from scratch.
>
> That's why most professionals would put a proxy between the public repo and their final dev platforms, which runs security checks before tagging the version as safe.
>
> Another widely used solution, although not just used...

**@rahmandevbd** · 3 upvotes

> That’s very shocking news! Hope all are will be safe.

## Similar posts on daily.dev

- [How to use GitHub safely](https://daily.dev/posts/how-to-use-github-safely-si4qd9ybx) · Security Boulevard · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#python](https://daily.dev/tags/python), [#open-source](https://daily.dev/tags/open-source), [#github](https://daily.dev/tags/github), [#malware](https://daily.dev/tags/malware)

[View this post on daily.dev](https://daily.dev/posts/github-has-a-malware-problem-uhdki0gty)