The Phantom Commit: How Attackers Exploited GitHub's Trust System

This incident exposes a critical flaw in GitHub's commit verification system: attackers forged automated commits that bypassed detection and infiltrated five repositories with credential-stealing malware targeting VS Code, Claude Code, and other popular development tools. Even security-conscious early adopters proved vulnerable, and GitHub's delayed response has left the malicious payload accessible and downloadable while the compromised account remains locked out.