DeceptiveDevelopment hackers steal developer credentials to poison GitHub repositories and software packages
THREAT ACTORCursorredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
ESET reports that DeceptiveDevelopment, a North Korea-aligned group, used stolen Git credentials, SSH keys and tokens between April and September 2026 to alter public and private repositories, often rewriting commit history. Poisoned code appeared on npm, the Go module mirror, Packagist, PyPI and browser extension marketplaces, and the group deployed the OmniStealer infostealer and the DEVPOPPER remote access trojan.
For IT people · Written by AI from 1 source · Wrong?
What to do
- No action needed: this one is for your information.
General advice for this kind of story
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Threat actors