GitVenom dressed hundreds of repositories over several years to ship AsyncRAT and Quasar

None of these three chains involved an exploit; the work being billed for was dressing. GitVenom's operators wrote professional READMEs, possibly generated with AI, built realistic commit histories, and tagged repositories with topics that matched popular developer interests, across hundreds of repositories over several years ^[1]. With more than 100 million repositories on the platform ^[9], a few hundred convincing ones cost nothing in signal-to-noise. A commit history is among the cheapest artifacts in software to fabricate and the slowest to earn.

The Lumma Stealer operation ran on the same asset. Repository names resembled popular legitimate tools, and release notes mimicked authentic software announcements ^[4]. The precondition Tant names is behavioural rather than technical: developers are conditioned to treat GitHub-hosted releases as legitimate software distributions ^[14]. The executable then arrives over the same hostname, through the same feature, as the real thing.

The figure I would interrogate before repeating is 1,300. The post says researchers identified over 1,300 repositories vulnerable to RepoJacking, which it defines as hijacking an existing repository and injecting malicious code into projects developers already trust ^[12]. That describes the outcome, not the precondition. It does not say who scanned, when, what counted as vulnerable, or whether the exposed names have since been claimed defensively. Without those, you cannot diff the list against your own dependencies, which is the only reason the count would matter to you rather than to a slide.

The proceeds number dates itself. Roughly five Bitcoin, described in the post as worth approximately US$440,000 ^[13]. That implies about $88,000 a coin ^[15], in a piece published on January 21, 2026 ^[8]. The five coins are the finding, while the dollar figure is just a quote from one afternoon.

Then the transfer question. The post's opening credits recent investigations with campaigns affecting nearly one million devices ^[7]. That reads as the Storm-0409 total again rather than an additional population, so the two figures should not be added ^[11]. GitVenom's bait was Instagram automation, Telegram bots and game hacking utilities ^[2], which sits closer to a working developer than streaming-site advertising does, and still closer to a weekend side project than to anything pinned in a build.

What does transfer is the takedown economics. The Storm-0409 operators maintained multiple repositories precisely so that removal of any one would not stop delivery ^[6]. Reporting a URL therefore buys hours. In my context, with third-party tooling entering builds from paths nobody re-verifies, that pushes the check onto the artifact instead of the location: a signature, or a hash I recorded myself and compare on the way in. The path stood in for a publisher check I never actually did.