Resource created as part of Paul McCarty and Jenn Gile’s TI Essentials article: “How to collect intelligence from GitHub on open source malware” | Published May 14, 2026 | feedly.com/ti-essentials/

GitHub Collection Cheat Sheet for Open Source Malware

Step 1: Search GitHub for payload signatures. Go to github.com/search, select the Code tab, and search for known marker strings filtered by filename: SIGNATURE path:FILENAME

• Add fork:only to surface infected repos staged for upstream PR attacks
• Switch to the Pull Requests tab to find active injection attempts, check both open and closed states
• Also search for known propagation scripts and artifacts: path:FILENAME

Hint: Use the GitHub CLI to bulk collect results across multiple filenames at once: gh search code "SIGNATURE" --filename FILENAME --limit 100 --json repository,path,url

Step 2: Decode any encoded values you find. Copy the encoded string from the file and run it in your terminal: echo "BASE64_STRING" | base64 -d

Step 3: Retrieve dead drop content. Take the decoded URL and retrieve its contents: curl -s "URL"

Step 4: Pivot on infrastructure and identities.

• Search GitHub for commit author emails across other repositories
• Search GitHub and npm for the author field in package.json

Step 5: Report your findings.

Share with the community on opensourcemalware.com