GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos
An ongoing attack that uses the stolen GitHub tokens to insert malware into hundreds of Python repositories is being fueled by the GlassWorm malware campaign.
By adding obfuscated code to files like setup.py, main.py, and app.py, the attack targets Python projects, including Django apps, ML research code, Streamlit dashboards, and PyPI packages, according to StepSecurity. The malware will be activated by anyone who clones and runs the code or runs pip install from a hacked repository.
The software supply chain security firm claims that the first injections occurred on March 8, 2026. After gaining access to the developer accounts, the attackers use malicious code to rebase the most recent legitimate commits on the default branch of the targeted repositories. They then force-push the ...