Damage from malicious code spreads on development platform 'GitHub'
Damage caused by the inclusion of malicious programs (malware) has been confirmed on platforms such as "GitHub," which is used by software developers around the world. According to investigations by experts, it has been discovered that malicious code has been embedded in over 151 projects.
In this attack, special characters known as "invisible characters," which cannot be seen on screen, are being used. By hiding these characters within the program, the mechanism makes it difficult for developers to notice that malicious instructions are included, even when they review the code.
This issue is occurring not only on GitHub but across a wide range of development environments, including systems that manage JavaScript libraries and tools. Because programs shared by many developers are being compromised, there is a risk that the damage could spread to the systems of companies and individuals who use them.
Currently, security experts are calling on developers to re-examine the code they are using for any suspicious elements. While platform providers are also strengthening their countermeasures, the situation has shaken the reliability of development infrastructure, and caution is required.