# GitHub Dismisses Worm Vulnerability Reports as Shai-Hulud Supply Chain Attacks Proliferate **GitHub** has formally rejected two vulnerability reports from threat intelligence group **Deep Specter Research**, despite evidence suggesting design flaws are facilitating the widespread **Shai-Hulud** supply-chain worm. The reports, submitted via **GitHub's** bug disclosure channel on HackerOne, were both closed as ineligible and not presenting a security risk. ## The Expanding Reach of Shai-Hulud Originating with the **TeamPCP** cybercrime group, **Shai-Hulud** variants have spread significantly since the original code's publication in early May. Over recent months, these variants have been implicated in breaches affecting prominent entities such as the **European Commission**, AI recruiting firm **Mercor**, the **LiteLLM** package, **GitHub** itself, and **Red Hat**. **Deep Specter Research's** investigation, relying solely on public data, has identified 516 malicious packages currently active across five ecosystems, including npm, PyPI, and RubyGems. The research also pinpointed over 3,000 affected **GitHub** repositories and more than 200 compromised developer accounts. These figures are considered a conservative estimate, as **GitHub's** code search limitations mean the worm's primary payload – a 4.6 MB obfuscated file – often remains invisible to automated scanning. ## Deep Specter's Rejected Reports ### Commit Timestamp Manipulation **Deep Specter's** first report highlighted how **GitHub** handles commit timestamps, allowing attackers to backdate when code was added to a repository. The worm exploits this feature to make recent malicious changes appear as routine edits from years past, effectively bypassing defenses designed to detect suspicious activity in a repository's history. **GitHub** responded that commit timestamps are client-supplied metadata by design, asserting that the root security issue lies with compromised credentials used to push code, not the timestamp feature itself. ### Impersonated Commit Authors **Deep Specter's** second report addressed the issue of commit author identification. **GitHub** displays author names, photos, and usernames as if verified, but these fields can be freely set by attackers. The worm leverages this to attribute malicious commits to trusted engineers who never interacted with the code. **GitHub** stated that arbitrary author metadata is an inherent property of the git version control system, not a **GitHub** vulnerability. The company also noted that its bug bounty program documentation explicitly lists commit author impersonation as an ineligible finding. To mitigate these issues, **GitHub** pointed researchers to **GPG** and **SSH** commit signing, and its opt-in **Vigilant Mode**. The developers whose identities were forged in the **Shai-Hulud** campaign had not enabled these controls. ## Visibility of Audit Trails Crucially, **GitHub** does record which account actually pushed each commit – data that cannot be forged – in its Events API. However, this critical information is not displayed on the commit page visible to reviewers and expires from public view after approximately 90 days. **Deep Specter** suggested improving the visibility of these records for enhanced security, but **GitHub** categorized this as a feature request rather than a security fix. As of June 16, **Deep Specter** reported 1,729 throwaway repositories created by the worm to store stolen credentials remained live on **GitHub**, alongside 151 repositories still serving active malicious payloads. These figures represent a snapshot of public data on that date. ## Microsoft's Broader Security Challenges This comes as **Microsoft**, **GitHub's** parent company, faces increasing scrutiny over its security posture and disclosure policies. Recently, **Microsoft** released fixes for over 200 security flaws – the largest Patch Tuesday in history – underscoring the escalating challenges in vulnerability discovery and mitigation, partly driven by advancements in AI. **Microsoft** has also faced renewed criticism for its disclosure practices, having recently clarified it had "no intention to pursue action" against security researchers after provoking an outcry from the community. Researchers have frequently complained about unfair dismissal of their vulnerability reports, and the company was previously described by the Biden administration as presiding over a "cascade of security failures" that allowed hackers to breach government systems. Further highlighting the breadth of credential-theft activity targeting the platform, another researcher recently published a separate **GitHub** token-stealing exploit targeting **Microsoft** repositories. The researcher made the exploit public due to dissatisfaction with **Microsoft's** handling of security reports. Neither **GitHub** nor **Microsoft** responded to requests for comment regarding these developments.