Annual Cyber Threat Report 2025-26
The 2025-26 Annual Cyber Threat Report highlights key threats, responses and security advice for Australians.
Code repositories
Since September 2025, ASD’s ACSC has tracked the ongoing targeting of online code repositories (repos). Malicious cyber actors have been observed accessing online code repos through social engineering techniques, compromised credentials and authentication tokens. These malicious cyber actors then:
- abuse legitimate tooling and functions to modify public software packages to initiate supply chain compromises,
- extract and publicly leak identified credentials publicly,
- migrate private code repos to public code repos, and
- run open-source tools to scan for cryptographic secrets, passwords and sensitive keys stored in online code repos, rather than use bespoke tooling. Exposed code bases give malicious cyber actors a better understanding of internal processes and systems, increasing an organisation’s attack surface and enabling future, novel attacks.
The compromise of trusted software packages presents an ongoing risk for organisations. These packages are often widely used and embedded as dependencies within other software, increasing the potential impact when vulnerabilities are identified.
To manage this risk effectively, organisations must be able to rapidly identify which software packages – and which specific versions – are installed across their environments. This information should be accurately collected, maintained and readily accessible. This enables organisations to quickly assess threat intelligence related to compromised software, determine its relevance to their environment, and take prompt action to reduce the risk of compromise.
Since September 2025, ASD’s ACSC has monitored a self-replicating malware (worm) known as ‘Shai-Hulud’, responsible for compromising hundreds of GitHub software packages.
After an initial compromise of a GitHub repo maintainer’s account, malicious cyber actors published a malicious version of a widely used software package. This poisoned package cascaded through downstream dependencies, enabling rapid and wide-spread infection across the software supply chain.
The ‘Shai-Hulud’ malware was designed to harvest credentials and exfiltrate them to an actor-controlled endpoint. It would then programmatically create a new public GitHub repo named ‘Shai-Hulud’ under the victim’s account and uploads the stolen secrets to it, publicly exposing them.
Using the stolen secrets, the malware can authenticate as the compromised developer, identify other packages maintained by that developer, inject malicious code, and publish the new compromised versions to the software registry. This automated process allows the malware to spread exponentially without direct intervention by the malicious cyber actor.
The ‘Shai-Hulud’ worm’s self-replicating design is particularly notable, effectively combining credential harvesting with an automated dissemination mechanism that exploits developer account permissions to spread. This highlights the risks in today’s interdependent software ecosystem and the importance of understanding and securing software supply chains.
- Malicious actor
Malicious actor compromises a trusted developed account and pushes a malicious version of a widely used software package. - Compromised package
Victim developer installs the poisoned package on Github repository. - Victim
After installation the malware starts running malicious code in the victims Github repository. - Proliferation
The malware harvests credentials and cloud metadata, exfiltrating them to an actor-controlled endpoint.- The malware then identifies other packages maintained by that developer, injecting malicious code, and publishing the new compromised versions to Github. This allows the malware to self-replicate, spreading without the malicious cyber actor's involvement.
- The malware then programmatically creates a new public Github repo under the victim's account and uploads the stolen secrets to it, publicly exposing them.
- Using the stolen credentials, the malware then authenticates, as the compromised developer.