A coordinated campaign has spun up roughly 10,000 fake GitHub repositories that clone real projects’ histories while swapping in malicious ZIP links and AI-written READMEs. Engineering teams, dependency scanners, and security ops need to treat repository search results and automated dependency pulls as potential attack surfaces, not trusted signals. Organized supply-chain mimicry, not random uploads […]