Hackers have found a way to automate duplicating malicious GitHub packages, bombarding the open source cloud repository with millions of repos capable of stealing sensitive information and information cookies.
Cybersecurity researchers from Apiiro Matan Giladi and Gil David explained how since the middle of 2023, hackers have engaged in a typosquatting attack against software developers on an enormous scale. First, they would clone an existing repository, possibly one that’s popular among the developers (such as WhatsappBOT, discord-boost-too, and similar), and infect it with a malware loader.
