GlassWorm Malware Uses Stolen GitHub Tokens to Inject Malicious Code into Python Repositories

The GlassWorm malware campaign is fueling a sophisticated attack that leverages stolen GitHub tokens to inject malware into hundreds of Python repositories.

Targeting Python Projects

According to StepSecurity, the campaign focuses on Python projects — including Django applications, machine learning research code, Streamlit dashboards, and PyPI packages — by appending obfuscated code to files such as setup.py, main.py, and app.py.

Anyone who installs packages via pip from a compromised repository or clones and executes the code risks triggering the malware.

The earliest injections were traced back to March 8, 2026. Attackers gain access to developer accounts, rebase legitimate commits with malicious code on the default branch, and force-push changes while retaining the original commit message, author, and timestamp.

ForceMemo Campaign Mechanics

This offshoot of GlassWorm has been codenamed ForceMemo.

The attack unfolds in four steps:

1. Developer System Compromise: GlassWorm infects systems via malicious Visual Studio Code and Cursor extensions that steal secrets, including GitHub tokens.
2. Repository Injection: Stolen credentials are used to force-push malicious changes across all repositories managed by the compromised account. The malware is appended to setup.py, main.py, or app.py.
3. Payload Execution: The Base64-encoded payload checks the system locale; it skips execution if set to Russian. Otherwise, it queries the transaction memo field of a Solana wallet previously linked to GlassWorm to obtain the payload URL https://solana.com/.
4. Additional Malware Deployment: The attacker downloads encrypted JavaScript designed to steal cryptocurrency and other sensitive data.

Historical Context and Supply Chain Abuse

The earliest C2 transaction was recorded on November 27, 2025 — months before the first GitHub repo injections — with a total of 50 transactions as the attacker updated the payload URL frequently https://etherscan.io/.

Socket security researchers noted a new iteration of GlassWorm that uses extensionPack and extensionDependencies to improve survivability and evade detection.

Aikido Security confirmed that over 151 GitHub repositories were compromised using invisible Unicode characters to conceal malicious code, all fetching instructions from the same Solana wallet infrastructure.

Malware Injection Techniques

StepSecurity highlighted that the attacker force-pushes malware to the default branch, rewriting git history while preserving commit metadata. This leaves no trace in GitHub’s UI — a unique technique in software supply chain attacks.

Impact on npm Packages

Two React Native npm packages — react-native-international-phone-number and react-native-country-select — maintained by user “astroonauta” were briefly compromised. Rogue versions were detected on March 16, 2026, with preinstall hooks invoking obfuscated JavaScript to:

• Skip Russian victims based on environment and OS time zone
• Query a hard-coded Solana wallet for the payload URL
• Deliver platform-specific malware executed entirely in memory

The payload runs via eval() on macOS/Linux or Node.js vm.Script sandbox on other platforms. A persistence lock is written to ~/init.json to prevent re-execution within 48 hours.

Cybersecurity Implications

The ForceMemo campaign illustrates the growing risk of software supply chain attacks, emphasizing the need for:

• Vigilance in using VS Code extensions and third-party dependencies
• Monitoring GitHub accounts for unauthorized access
• Validating code before installing or executing
• Enhanced awareness of cryptocurrency-targeted malware