GitHub Repositories Used to Distribute NodeJS Infostealer Malware

Threat actors have been exploiting GitHub repositories to distribute a NodeJS infostealer malware. The campaign, tracked by Netskope Threat Labs, uses a loader called SmartLoader that relies on EtherHiding to retrieve C2 IP addresses from the Polygon blockchain.

The attackers create trojanized GitHub repositories that impersonate popular AI tools and developer resources. Once downloaded, the malware prepares a payload containing the victim's unique GUID, OS version, and public IP, which is then sent via an unencrypted HTTP POST request to the C2 server.

Organizations are advised to enforce strict controls over downloading and executing unverified scripts or binaries from public repositories like GitHub. Developers should verify repository ownership, contributor legitimacy, and installation instructions before using external downloads.