The worm blends in with thousands of other commands occurring daily in any given environment, yet its intent and origins remain unknown.

The threat group’s remarkable success targeting open-source software was inevitable and fueled by the industry’s decision to prioritize code shipping over security.

The campaign hit major registries and hid behind legitimate-looking release signatures, showing how attackers can weaponize the software update process itself.

Socket researchers said the malware-ridden packages were collectively downloaded over 330 times. GitHub removed all of the malicious packages Wednesday.