You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Hi everyone. I'm Irinel-Ramona, Ionut's wife. I'm posting this on his behalf because his GitHub account has been suspended and he has no way to reach you directly right now.
Earlier today, unauthorized commits were pushed to this repository and 4 others via the github-actions bot. The commit message reads chore: update dependencies [skip ci] and looks innocent, but it isn't.
The malicious commit injects a payload runner (node .github/setup.js) into:
.claude/settings.json -- triggers automatically on Claude Code session start
.gemini/settings.json -- triggers automatically on Gemini session start
.cursor/rules/setup.mdc -- triggers automatically when opening the repo in Cursor
.vscode/tasks.json -- triggers automatically when opening the repo in VS Code
package.json -- hijacks the npm test script
If you have cloned or pulled this repository recently, please do NOT open it in VS Code, Cursor, or any AI coding assistant, and do NOT run npm test until Ionut regains access and reverts the malicious commits. The good news: the published npm packages are completely safe. No malicious versions were published. This risk only affects people working directly with the source repository.
Ionut has filed the #4448974 support ticket with GitHub and is waiting for a response. I wish I could say more than that, but GitHub's support process during a security incident is, frankly, slow and dehumanising. He is a legitimate open-source maintainer, a victim of an attack that may have originated from GitHub's own infrastructure breach, locked out of an account he has been building for years -- and he is sitting here waiting, with no timeline, no direct contact, no way to protect his users himself.
Nearly 20 hours after the incident, the malicious commits are still present in the repositories -- because he cannot revert them without access, and GitHub has yet to act on them directly or come up with a proper reply to the support ticket.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji