githash docs

threats
Threats githash tracks, and the files they spread.

BeaverTail active

North Korea-linked loader in fake job-interview repos that fetches and runs a second stage.
18 hashes21 repos19 accountslast seen first reported

Gheist active

Stolen GitHub tokens used to plant workflows that print repository secrets into Actions logs.
3 hashes2 repos2 accountslast seen first reported

testmetest active

npm worm that arms hijacked GitHub repos with a hidden script run by AI and editor hooks.
116 hashes909 repos620 accountslast seen first reported

FakeGit active

GitHub repos whose download links serve a SmartLoader ZIP.
87 hashes49 repos9 accountslast seen

GhostAction active

Stolen GitHub accounts used to push workflows that send repository secrets to the attacker.
1,189 hashes3,042 repos985 accountslast seen first reported

Shai Hulud active

Self-spreading npm and PyPI worm that steals developer and CI credentials.
63 hashes176 repos91 accountslast seen

OtterCookie active

North Korea-linked stealer delivered through fake job coding tests.
14 hashes19 repos13 accountslast seen

Megalodon active

Mass-injected GitHub Actions workflows that steal CI secrets.
1,394 hashes1,426 repos419 accountslast seen first reported

PolinRider active

North Korea-linked malware hidden in project config files and fake fonts.
10,060 hashes14,712 repos4,684 accountslast seen