The campaign hit major registries and hid behind legitimate-looking release signatures, showing how attackers can weaponize the software update process itself.

Self-replicating malware has infected almost 500 open-source packages, exposing more than 26,000 GitHub repositories in less than 24 hours.

Commentary that downplays the compromise’s impact misses the point, the co-founder of Sonatype argues.

Disaster was averted after widely used open-source packages were compromised via social engineering.

Socket researchers said the malware-ridden packages were collectively downloaded over 330 times. GitHub removed all of the malicious packages Wednesday.