ForceMemo: GitHub Python repositories hijacked via account takeover

Researchers have uncovered the ForceMemo campaign, in which attackers compromise GitHub developer accounts using credentials previously harvested by the GlassWorm malware. With that access they inject identical obfuscated malicious code into Python repositories the developers control. The code is appended to key files such as setup.py and main.py, and the changes are force-pushed while preserving original commit metadata, making the tampering hard to spot.

What this means for your organisation

This is an attack on trust in open source code. Anyone installing or running code from an affected repository may execute the malware, often inside a build environment with access to secrets and production systems. Because the changes appear to come from the legitimate developer, ordinary controls based on who made a change do not catch it. Traceability in the software supply chain is an explicit topic in both NIS2 and ISO/IEC 27001.

Berigo recommends

• Pin dependencies to specific versions and checksums rather than to branches or latest.
• Require multi-factor authentication and signed commits on your own repositories, and restrict who can force-push.
• Run builds in isolated environments with minimal access to secrets and production.
• Maintain a software inventory that lets you answer quickly whether an affected library is in use.

Source

• stepsecurity.io