Impact
We identified malicious content committed to this repository as part of a broader GitHub compromise incident affecting multiple repositories.
The suspicious changes were introduced in this commit:
This commit added multiple files consistent with the “PolinRider / BeaverTail” attack pattern, including:
-
Malicious payload disguised as a font file
public/fonts/fa-solid-400.woff2
-
VS Code workspace configuration that can trigger code execution on open
.vscode/tasks.json (includes a task configured to run on folderOpen).vscode/settings.json, .vscode/launch.json, .vscode/extensions.json, etc.
-
Propagation/tooling indicators referenced in .gitignore
branch_structure.jsontemp_auto_push.battemp_interactive_push.bat
Who is impacted: anyone who cloned, pulled, or checked out an affected revision while these malicious files were present. Risk is higher for anyone who opened the repository in VS Code/Cursor (or similar editors) and for any CI runner that built/tested an affected revision, as this malware family is typically associated with credential/token theft.
Timeframe (UTC)
Start: 2026-06-01 20:56:00
End: 2026-06-02 03:00:00
Patches
The malicious content has been removed from the repository as part of incident response. Users should ensure they are on a known-clean revision of the default branch and that none of the files listed above exist in their local working copy.
Workarounds
If you cloned/pulled the repository during the incident window, we recommend:
- Stop using the existing local clone. Delete the repository directory and re-clone from the cleaned default branch.
- Treat the machine as potentially compromised until verified, especially if you:
- opened the repo in VS Code/Cursor, or
- ran builds/tests/CI jobs against the affected revision.
- Rotate credentials that may have been present on the machine/runner (GitHub tokens, CI secrets, npm tokens, SSH keys, and any other environment credentials).
- Optionally, check for the specific artifacts listed above in any existing clones or backups.
References
Impact
We identified malicious content committed to this repository as part of a broader GitHub compromise incident affecting multiple repositories.
The suspicious changes were introduced in this commit:
This commit added multiple files consistent with the “PolinRider / BeaverTail” attack pattern, including:
Malicious payload disguised as a font file
public/fonts/fa-solid-400.woff2VS Code workspace configuration that can trigger code execution on open
.vscode/tasks.json(includes a task configured to run onfolderOpen).vscode/settings.json,.vscode/launch.json,.vscode/extensions.json, etc.Propagation/tooling indicators referenced in
.gitignorebranch_structure.jsontemp_auto_push.battemp_interactive_push.batWho is impacted: anyone who cloned, pulled, or checked out an affected revision while these malicious files were present. Risk is higher for anyone who opened the repository in VS Code/Cursor (or similar editors) and for any CI runner that built/tested an affected revision, as this malware family is typically associated with credential/token theft.
Timeframe (UTC)
Start: 2026-06-01 20:56:00
End: 2026-06-02 03:00:00
Patches
The malicious content has been removed from the repository as part of incident response. Users should ensure they are on a known-clean revision of the default branch and that none of the files listed above exist in their local working copy.
Workarounds
If you cloned/pulled the repository during the incident window, we recommend:
References
ce5b5f4
https://github.com/OpenSourceMalware/PolinRider
https://opensourcemalware.com/blog/polinrider-attack