ForceMemo GitHub Supply-Chain Attack

Seed topic

ForceMemo GitHub repository poisoning and developer supply-chain risk.

Field: Seed topic Value: ForceMemo GitHub repository poisoning and developer supply-chain risk.

Decision Question

How should defenders scope repository poisoning, force-push abuse, stolen GitHub credentials, and CI/CD exposure?

Field: Decision Question Value: How should defenders scope repository poisoning, force-push abuse, stolen GitHub credentials, and CI/CD exposure?

Interpreted Questions

Which repositories and identities were exposed, did malicious changes execute or propagate into builds, packages, runners, production systems, or downstream users, and which credentials, tokens, artifacts, and logs must be preserved or rotated?

Field: Interpreted Questions Value: Which repositories and identities were exposed, did malicious changes execute or propagate into builds, packages, runners, production systems, or downstream users, and which credentials, tokens, artifacts, and logs must be preserved or rotated?

Initial Observations

The retained ForceMemo-specific reporting describes compromised GitHub accounts, force-pushed Python repository changes, modified entry points, and Solana memo-based command retrieval. Related GlassWorm reporting provides ecosystem context but does not independently confirm every ForceMemo artifact.

Field: Initial Observations Value: The retained ForceMemo-specific reporting describes compromised GitHub accounts, force-pushed Python repository changes, modified entry points, and Solana memo-based command retrieval. Related GlassWorm reporting provides ecosystem context but does not independently confirm every ForceMemo artifact.

Evidence Hierarchy / Tier 0 Through Tier 8 Coverage

Tier 0 and Tier 1 authoritative platform and government guidance define repository, identity, token, CI/CD, and response controls; Tier 2 and Tier 3 security research and corroborating reporting provide campaign evidence and context; Tiers 4 through 8 were reviewed for community, custom, integration, inner-discovery, and expansion evidence and were not promoted when they did not independently strengthen the retained record.

Field: Evidence Hierarchy / Tier 0 Through Tier 8 Coverage Value: Tier 0 and Tier 1 authoritative platform and government guidance define repository, identity, token, CI/CD, and response controls; Tier 2 and Tier 3 security research and corroborating reporting provide campaign evidence and context; Tiers 4 through 8 were reviewed for community, custom, integration, inner-discovery, and expansion evidence and were not promoted when they did not independently strengthen the retained record.

Fact / Analysis / Unknown Boundaries

StepSecurity is the primary ForceMemo-specific source; GlassWorm sources are retained as related ecosystem context, not as a substitute for direct ForceMemo evidence. Public reporting does not provide a complete victim list or prove that every poisoned repository change executed or reached downstream users.

Field: Fact / Analysis / Unknown Boundaries Value: StepSecurity is the primary ForceMemo-specific source; GlassWorm sources are retained as related ecosystem context, not as a substitute for direct ForceMemo evidence. Public reporting does not provide a complete victim list or prove that every poisoned repository change executed or reached downstream users.

Primary surface

Public GitHub Python repositories, developer identities, GitHub tokens, and CI/CD workflows.

Snapshot Field: Primary surface Current Assessment: Public GitHub Python repositories, developer identities, GitHub tokens, and CI/CD workflows.

Core tradecraft

Account takeover, force-push repository poisoning, Python entry-point modification, and Solana memo-based command retrieval.

Snapshot Field: Core tradecraft Current Assessment: Account takeover, force-push repository poisoning, Python entry-point modification, and Solana memo-based command retrieval.

Business risk

Trusted source code can become an upstream compromise path into builds, developer systems, packages, and downstream customers.

Snapshot Field: Business risk Current Assessment: Trusted source code can become an upstream compromise path into builds, developer systems, packages, and downstream customers.

This brief is written for engineering leaders, DevOps owners, SOC/IR teams, threat-intelligence analysts, breach counsel, cyber insurers, claims teams, and SMB leaders who depend on GitHub-hosted code, open-source packages, or CI/CD automation. The page prioritizes evidence that helps separate repository exposure from actual execution, build propagation, or downstream customer impact.

AI monitoring agent

Enabled July 4, 2026. The ForceMemo AI Monitoring Agent is now assigned to this page for production Page Alerts and future source-backed updates.

Field: AI monitoring agent Value: Enabled July 4, 2026. The ForceMemo AI Monitoring Agent is now assigned to this page for production Page Alerts and future source-backed updates.

AI-driven updates

1x via AI Monitoring Agents. This run enabled production Page Alerts and card-level delta email support; no new source-backed ForceMemo threat-intel finding was added in this enablement update.

Field: AI-driven updates Value: 1x via AI Monitoring Agents. This run enabled production Page Alerts and card-level delta email support; no new source-backed ForceMemo threat-intel finding was added in this enablement update.

Alert email behavior

Future production monitor changes can notify active Page Alerts subscribers with touched cards and only added, revised, or deleted text from those cards.

Field: Alert email behavior Value: Future production monitor changes can notify active Page Alerts subscribers with touched cards and only added, revised, or deleted text from those cards.

Reader update

Converted to the standardized PANDA card drawer, 32-card layout, compact header, and first-visit locked-card defaults.

Field: Reader update Value: Converted to the standardized PANDA card drawer, 32-card layout, compact header, and first-visit locked-card defaults.

Developer Trust Is Production Risk

ForceMemo matters because it attacks the trust chain before code reaches production. A poisoned repository can turn ordinary clone, install, build, or test behavior into the first step of an intrusion.

Identity Becomes the Initial Access Path

The campaign highlights stolen developer credentials, token hygiene, force-push controls, and branch protections as business-critical controls, not just engineering preferences.

Claims and Legal Scope Can Expand Quickly

If compromised code entered CI/CD, packages, customer artifacts, or downstream environments, the issue may become a third-party exposure, notification, contractual, or insurance matter.

The Right Decision Is Evidence-Gated

Teams should not assume every GitHub user is affected, but they should quickly prove whether relevant repositories, tokens, runners, packages, or developer machines intersect with the ForceMemo pattern.

Nov. 27, 2025

StepSecurity reports Solana memo activity associated with the wallet later used by ForceMemo, showing command-channel preparation before the GitHub injection wave.

Period: Nov. 27, 2025 Known Event / Signal: StepSecurity reports Solana memo activity associated with the wallet later used by ForceMemo, showing command-channel preparation before the GitHub injection wave. Why IR / SOC Teams Care: Threat intel teams should treat the campaign infrastructure as pre-positioned before the public repository activity became visible.^{[1] [7]}

Feb. 2026

Koi reports GlassWorm evolution affecting macOS and using fresh infrastructure, with Solana memo infrastructure remaining part of the broader tradecraft.

Period: Feb. 2026 Known Event / Signal: Koi reports GlassWorm evolution affecting macOS and using fresh infrastructure, with Solana memo infrastructure remaining part of the broader tradecraft. Why IR / SOC Teams Care: Shows related developer-ecosystem activity remained active shortly before the ForceMemo wave.^[3]

Mar. 8, 2026

StepSecurity identifies earliest ForceMemo GitHub injections in public Python repositories.

Period: Mar. 8, 2026 Known Event / Signal: StepSecurity identifies earliest ForceMemo GitHub injections in public Python repositories. Why IR / SOC Teams Care: This is the start point for repository-history review and exposure-window scoping.^[1]

Mar. 13, 2026

StepSecurity reports 240+ affected repositories in the ForceMemo wave; Socket separately reports 72 malicious Open VSX extensions linked to GlassWorm activity.

Period: Mar. 13, 2026 Known Event / Signal: StepSecurity reports 240+ affected repositories in the ForceMemo wave; Socket separately reports 72 malicious Open VSX extensions linked to GlassWorm activity. Why IR / SOC Teams Care: Shows both GitHub repository poisoning and developer extension ecosystem abuse matter for the same defensive audience.^{[1] [4]}

March 2026

Security media and community channels amplify the issue, emphasizing stolen GitHub tokens, force-push behavior, invisible Unicode context, and repository integrity concerns.

Period: March 2026 Known Event / Signal: Security media and community channels amplify the issue, emphasizing stolen GitHub tokens, force-push behavior, invisible Unicode context, and repository integrity concerns. Why IR / SOC Teams Care: Helpful for awareness, while primary technical evidence should stay anchored to the research sources.^{[8] [9] [10] [12] [13] [14]}

Current control window

GitHub branch protection and token management guidance provide immediate preventive controls: restrict force-pushes, require review/status checks, minimize token scopes, and rotate or revoke exposed credentials.

Period: Current control window Known Event / Signal: GitHub branch protection and token management guidance provide immediate preventive controls: restrict force-pushes, require review/status checks, minimize token scopes, and rotate or revoke exposed credentials. Why IR / SOC Teams Care: These controls map directly to the ForceMemo abuse path.^{[5] [6]}

1. Prove the GitHub identity path

Collect GitHub organization/repository audit logs, account login history, PAT/SSH/deploy-key activity, OAuth/GitHub App grants, MFA changes, and the exact actor that pushed or force-pushed to the repository.

Forensic Step: 1. Prove the GitHub identity path Evidence to Collect / Analyze: Collect GitHub organization/repository audit logs, account login history, PAT/SSH/deploy-key activity, OAuth/GitHub App grants, MFA changes, and the exact actor that pushed or force-pushed to the repository. What This Proves: You are trying to prove whether a threat actor authenticated to GitHub with stolen credentials or a stolen token, not merely whether malware exists on a workstation.^{[1] [5] [6]}

2. Preserve and compare repository history

Mirror-clone affected repositories, preserve refs/branches/tags, capture commit SHAs, compare default branch state to known-good clones/forks/releases, and inspect setup.py, main.py, app.py, manage.py, and other execution entry points.

Forensic Step: 2. Preserve and compare repository history Evidence to Collect / Analyze: Mirror-clone affected repositories, preserve refs/branches/tags, capture commit SHAs, compare default branch state to known-good clones/forks/releases, and inspect setup.py, main.py, app.py, manage.py, and other execution entry points. What This Proves: Look for force-push history rewriting, unfamiliar commit hashes, the marker variable lzcdrtfxyqiplpd, XOR key 134, Solana RPC logic, Node.js download behavior, and the i.js payload artifact.^[1]

3. Examine CI/CD and runner exposure

Collect workflow definitions, runner logs, build artifacts, package publishing logs, secrets access, environment variables, and egress telemetry from CI runners.

Forensic Step: 3. Examine CI/CD and runner exposure Evidence to Collect / Analyze: Collect workflow definitions, runner logs, build artifacts, package publishing logs, secrets access, environment variables, and egress telemetry from CI runners. What This Proves: Determine whether poisoned code executed in automation and whether it reached build secrets, deployment credentials, package artifacts, nodejs.org, Solana RPC endpoints, or reported payload IPs.^{[1] [6]}

4. Review developer endpoints

Collect local clones, shell history, package install logs, IDE extension inventory, browser token stores if appropriate, EDR telemetry, Git credential helpers, and recent npm/pip/VS Code/Open VSX activity.

Forensic Step: 4. Review developer endpoints Evidence to Collect / Analyze: Collect local clones, shell history, package install logs, IDE extension inventory, browser token stores if appropriate, EDR telemetry, Git credential helpers, and recent npm/pip/VS Code/Open VSX activity. What This Proves: This establishes whether the repository compromise came from or spread to developer workstations and whether related GlassWorm-style extension/token theft is plausible.^{[1] [2] [3] [4]}

5. Contain and recover

Revoke and rotate PATs, SSH keys, deploy keys, GitHub App tokens, package-registry tokens, CI secrets, and cloud deployment credentials; restore clean branches; disable force-push; and rebuild artifacts from trusted commits.

Forensic Step: 5. Contain and recover Evidence to Collect / Analyze: Revoke and rotate PATs, SSH keys, deploy keys, GitHub App tokens, package-registry tokens, CI secrets, and cloud deployment credentials; restore clean branches; disable force-push; and rebuild artifacts from trusted commits. What This Proves: Do not treat cleanup as complete until both identity credentials and poisoned repository contents have been remediated.^{[5] [6]}

6. Report impact and downstream risk

Document affected repos, commits, users, automation jobs, artifacts, dependencies, package releases, downstream consumers, IOCs, and confidence level.

Forensic Step: 6. Report impact and downstream risk Evidence to Collect / Analyze: Document affected repos, commits, users, automation jobs, artifacts, dependencies, package releases, downstream consumers, IOCs, and confidence level. What This Proves: The key business question is whether the event stayed inside source control or propagated to customers, production systems, or third parties.^{[1] [8] [9]}

This is a remote-investigation playbook for determining whether a ForceMemo-style repository compromise happened, how far it went, and whether it reached developer machines, CI/CD runners, packages, customers, or production systems.

Branch Protection

GitHub rules that make important branches harder to change without review, status checks, or approval.

Term: Branch Protection Simple Definition: GitHub rules that make important branches harder to change without review, status checks, or approval. Why It Matters Here: ForceMemo abused default-branch writes, so protected branches and force-push restrictions are central controls.

Command and Control (C2)

The method malware uses to receive instructions or retrieve the next payload after it starts running.

Term: Command and Control (C2) Simple Definition: The method malware uses to receive instructions or retrieve the next payload after it starts running. Why It Matters Here: ForceMemo used Solana memo data as the instruction channel instead of relying only on a single server.

CI/CD

Continuous Integration / Continuous Delivery or Continuous Deployment: automated build, test, and release systems used by engineering teams to turn source code into software.

Term: CI/CD Simple Definition: Continuous Integration / Continuous Delivery or Continuous Deployment: automated build, test, and release systems used by engineering teams to turn source code into software. Why It Matters Here: Poisoned repositories can execute during installation, testing, or automated build workflows.

CI Runner

A server, container, or virtual machine that automatically runs build, test, packaging, or deployment jobs when code changes.

Term: CI Runner Simple Definition: A server, container, or virtual machine that automatically runs build, test, packaging, or deployment jobs when code changes. Why It Matters Here: If poisoned code runs inside a CI runner, it may reach build secrets, deployment credentials, generated artifacts, or outbound network paths.

Force-Push

A Git operation that overwrites remote branch history instead of adding a normal visible new commit on top.

Term: Force-Push Simple Definition: A Git operation that overwrites remote branch history instead of adding a normal visible new commit on top. Why It Matters Here: StepSecurity reports ForceMemo used force-pushes to preserve familiar-looking commit messages and authors while replacing clean code.

Git Repository

A source-code project folder with tracked history, branches, commits, and files used by developers to collaborate.

Term: Git Repository Simple Definition: A source-code project folder with tracked history, branches, commits, and files used by developers to collaborate. Why It Matters Here: ForceMemo turned trusted repositories into malware distribution points.

GitHub Token / Personal Access Token (PAT)

A credential that lets tools or users access GitHub without typing a password every time.

Term: GitHub Token / Personal Access Token (PAT) Simple Definition: A credential that lets tools or users access GitHub without typing a password every time. Why It Matters Here: Stolen tokens can let an attacker push code, read private repositories, or access automation workflows.

Invisible Unicode

Characters that are valid text but appear blank or nearly invisible in many editors and review tools.

Term: Invisible Unicode Simple Definition: Characters that are valid text but appear blank or nearly invisible in many editors and review tools. Why It Matters Here: Related GlassWorm activity used invisible Unicode to hide malicious JavaScript from human reviewers.

Solana Memo

Small text data attached to a Solana blockchain transaction.

Term: Solana Memo Simple Definition: Small text data attached to a Solana blockchain transaction. Why It Matters Here: ForceMemo read payload instructions from memo data, making those instructions difficult to remove once posted on-chain.

Supply-Chain Attack

An attack that compromises software, tools, updates, dependencies, or vendors that other organizations trust.

Term: Supply-Chain Attack Simple Definition: An attack that compromises software, tools, updates, dependencies, or vendors that other organizations trust. Why It Matters Here: ForceMemo targets developer trust before software reaches production users.

Valid Accounts / Stolen GitHub Tokens

T1078

TTP: Valid Accounts / Stolen GitHub Tokens MITRE ATT&CK: T1078 Description & Context: Compromised GitHub credentials and tokens let the attacker act as the repository owner and push changes without triggering the same suspicion as an external exploit.^{[1] [6] [8]}

Supply Chain Compromise

T1195

TTP: Supply Chain Compromise MITRE ATT&CK: T1195 Description & Context: The campaign poisoned trusted Python repositories so downstream users could execute malware through normal clone, install, or run workflows.^{[1] [8] [9]}

Obfuscated Files or Information

T1027

TTP: Obfuscated Files or Information MITRE ATT&CK: T1027 Description & Context: StepSecurity reports base64, zlib, XOR, randomized variable names, and an identical marker variable; related GlassWorm reporting describes invisible Unicode and staged obfuscation.^{[1] [2] [10]}

Command and Scripting Interpreter: Python / JavaScript

T1059

TTP: Command and Scripting Interpreter: Python / JavaScript MITRE ATT&CK: T1059 Description & Context: The malicious Python wrapper downloaded Node.js v22.9.0 and executed an encrypted JavaScript payload after retrieving instructions.^[1]

Web Service / Blockchain-Backed C2

T1102-like

TTP: Web Service / Blockchain-Backed C2 MITRE ATT&CK: T1102-like Description & Context: The malware queried Solana RPC endpoints for memo-based instructions, then fetched payloads from rotating server IPs.^{[1] [3] [7]}

Virtualization / Sandbox / Region Evasion

T1497-adjacent

TTP: Virtualization / Sandbox / Region Evasion MITRE ATT&CK: T1497-adjacent Description & Context: StepSecurity reports Russian locale, timezone, and UTC-offset checks that caused execution to skip on Russian systems.^[1]

Is ForceMemo a CVE-led event?

No. The retained reporting frames ForceMemo as account takeover, repository poisoning, and force-push abuse rather than one patchable vulnerability.

Question: Is ForceMemo a CVE-led event? Answer: No. The retained reporting frames ForceMemo as account takeover, repository poisoning, and force-push abuse rather than one patchable vulnerability.^[1]

Does this mean GitHub itself was exploited?

The public sources support compromised accounts or tokens and weak repository controls, not a GitHub platform exploit claim.

Question: Does this mean GitHub itself was exploited? Answer: The public sources support compromised accounts or tokens and weak repository controls, not a GitHub platform exploit claim.^{[1] [5] [6]}

What is the key scoping question?

Whether poisoned code was merely present in a repository or actually executed by developers, CI runners, package consumers, or production build systems.

Question: What is the key scoping question? Answer: Whether poisoned code was merely present in a repository or actually executed by developers, CI runners, package consumers, or production build systems.

No specific CVE identified

GitHub repositories, developer accounts, CI/CD runners, tokens, package-install workflows, and developer tooling

CVE Status: No specific CVE identified Affected Surface: GitHub repositories, developer accounts, CI/CD runners, tokens, package-install workflows, and developer tooling Why It Matters: The ForceMemo / GlassWorm pattern described in this brief is not anchored to one disclosed software vulnerability. The core risk is compromised developer identity, poisoned repository history, obfuscated code, and trusted automation paths. Practical Action: Treat this as an identity and software-supply-chain incident: rotate tokens, audit GitHub access, review force-push history, validate CI/CD execution, restrict direct GitHub installs, and inspect developer endpoints.^{[1] [2] [3] [4] [5] [6]}

Not every flash threat brief is CVE-led. ForceMemo is better understood as compromised developer trust and repository poisoning, not a single patchable public vulnerability.

Code marker

lzcdrtfxyqiplpd

Indicator Type: Code marker Value: lzcdrtfxyqiplpd Context: Marker variable used to find affected repositories.^[1]

Solana C2 address

BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC

Indicator Type: Solana C2 address Value: BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC Context: Wallet queried for memo-based payload instructions.^{[1] [3]}

Solana funding wallet

G2YxRa6wt1qePMwfJzdXZG62ej4qaTC7YURzuh2Lwd3t

Indicator Type: Solana funding wallet Value: G2YxRa6wt1qePMwfJzdXZG62ej4qaTC7YURzuh2Lwd3t Context: Wallet reported as funding the C2 address.^[1]

Committer email fingerprint

null

Indicator Type: Committer email fingerprint Value: null Context: String reported across many malicious commits.^[1]

XOR key

134

Indicator Type: XOR key Value: 134 Context: Used in the Python obfuscation wrapper.^[1]

Downloaded runtime

Node.js v22.9.0

Indicator Type: Downloaded runtime Value: Node.js v22.9.0 Context: Downloaded to execute the JavaScript payload.^[1]

Persistence file

~/init.json

Indicator Type: Persistence file Value: ~/init.json Context: Created with a two-day recheck timer.^[1]

Payload file

i.js

Indicator Type: Payload file Value: i.js Context: JavaScript payload file written in the script directory.^[1]

Payload server IP

217.69.0.159

Indicator Type: Payload server IP Value: 217.69.0.159 Context: Payload server observed in controlled execution and active in March 2026.^[1]

Payload server IPs

45.32.151.157, 45.32.150.97, 217.69.11.57, 217.69.11.99, 45.76.44.240

Indicator Type: Payload server IPs Value: 45.32.151.157, 45.32.150.97, 217.69.11.57, 217.69.11.99, 45.76.44.240 Context: Additional payload server IPs decoded from on-chain memo history.^[1]

Solana RPC endpoints

api.mainnet-beta.solana.com; solana-mainnet.gateway.tatum.io; go.getblock.us; solana-rpc.publicnode.com; api.blockeden.xyz; solana.drpc.org; solana.leorpc.com; solana.api.onfinality.io; solana.api.pocket.network

Indicator Type: Solana RPC endpoints Value: api.mainnet-beta.solana.com; solana-mainnet.gateway.tatum.io; go.getblock.us; solana-rpc.publicnode.com; api.blockeden.xyz; solana.drpc.org; solana.leorpc.com; solana.api.onfinality.io; solana.api.pocket.network Context: Fallback endpoints contacted to retrieve memo instructions.^[1]

ForceMemo

A campaign name used by StepSecurity for the GitHub account takeover and force-push wave that injected obfuscated Python malware into repositories.

Threat Actor / Campaign: ForceMemo Simple Definition: A campaign name used by StepSecurity for the GitHub account takeover and force-push wave that injected obfuscated Python malware into repositories. Why It Matters: It combines force-pushed repository history rewriting with Solana memo-based C2. StepSecurity reports 240+ ForceMemo-wave repositories between March 8 and March 13, 2026.^[1]

GlassWorm

A developer supply-chain threat actor/campaign family associated with malicious VS Code/Open VSX extensions, invisible Unicode payloads, credential theft, and Solana memo infrastructure.

Threat Actor / Campaign: GlassWorm Simple Definition: A developer supply-chain threat actor/campaign family associated with malicious VS Code/Open VSX extensions, invisible Unicode payloads, credential theft, and Solana memo infrastructure. Why It Matters: StepSecurity, Aikido, Koi, Socket, and security media connect ForceMemo to GlassWorm-related infrastructure or activity, though not every ForceMemo detail should be treated as independently confirmed by every source.^{[1] [2] [3] [4] [8] [9]}

Talking Point 1

This is a source-code trust problem: the attacker did not need to break production first; they poisoned repositories developers already trusted.

Talking Point 2

Force-push protection matters because the attack rewrote branch history while preserving familiar-looking author and commit metadata.

Talking Point 3

Direct installs from GitHub should be treated as higher risk than installs from controlled, pinned, verified package sources.

Talking Point 4

A Python install script contacting Solana RPC endpoints, downloading Node.js, or reaching unknown IPs is highly suspicious and should be blocked or investigated.

Talking Point 5

Developer laptops, IDE extensions, GitHub tokens, and CI/CD runners are now board-relevant assets because compromise can travel downstream into products and customers.

Talking Point 6

Insurance and risk teams should ask whether policyholders enforce branch protection, rotate developer tokens, monitor GitHub audit logs, and restrict CI/CD egress.

Engineering / DevOps

Lock down repository writes and default branches.

Audience: Engineering / DevOps Decision Ready Action: Lock down repository writes and default branches. Scoping Questions to Ask: Ask: Are force-pushes blocked on default branches? Are signed commits required? Who can push directly to protected branches? Are GitHub audit logs reviewed for force-push events? Why It Matters: ForceMemo specifically abused force-push behavior and preserved familiar-looking author metadata.^{[1] [5] [13]}

Incident Response

Prove or disprove a ForceMemo-style repository compromise.

Audience: Incident Response Decision Ready Action: Prove or disprove a ForceMemo-style repository compromise. Scoping Questions to Ask: Ask: Did a threat actor authenticate to GitHub with stolen credentials or a stolen token? Which account pushed to the repo? Was there a force-push to the default branch? Did the pushed files include common Python entry points such as setup.py, main.py, app.py, or manage.py? Do GitHub audit logs, commit hashes, branch history, and reflog/local clone comparisons show history rewriting? Was the marker variable lzcdrtfxyqiplpd, XOR key 134, Node.js v22.9.0 download, Solana RPC traffic, or the reported payload infrastructure observed? Why It Matters: A ForceMemo incident is proven by repository-history and identity evidence, not just by finding malware on a developer workstation.^{[1] [5] [6] [12]}

Incident Response

Contain the developer identity and build pipeline blast radius.

Audience: Incident Response Decision Ready Action: Contain the developer identity and build pipeline blast radius. Scoping Questions to Ask: Ask: Which PATs, SSH keys, deploy keys, GitHub Apps, CI secrets, browser tokens, package registry tokens, and IDE extension credentials were reachable from the affected user or runner? Did any CI runner execute the poisoned code? Did outbound logs show Solana RPC endpoints, nodejs.org download activity, or payload IP connections? Why It Matters: The cleanup path is credential rotation, repository rollback, runner review, artifact validation, and downstream notification where poisoned code may have propagated.^{[1] [6]}

Threat Intelligence

Build a campaign-confirmation package for ForceMemo / GlassWorm-style activity.

Audience: Threat Intelligence Decision Ready Action: Build a campaign-confirmation package for ForceMemo / GlassWorm-style activity. Scoping Questions to Ask: Ask: Do observed events match the ForceMemo pattern: stolen GitHub credential use, force-pushed repository history, Python entry-point tampering, Solana memo C2 lookups, known marker strings, and payload server infrastructure? Are there overlaps with GlassWorm tradecraft such as token theft, invisible Unicode, developer extension abuse, or Solana-backed instructions? Why It Matters: Threat intel should separate a generic repo compromise from ForceMemo-like tradecraft so leadership, IR, and claims teams do not overstate or understate attribution.^{[1] [2] [3] [4] [8] [9]}

Insurance Claims / Risk Scoping Calls

Scope whether this is a credential-theft, repository-poisoning, or downstream software-supply-chain claim.

Audience: Insurance Claims / Risk Scoping Calls Decision Ready Action: Scope whether this is a credential-theft, repository-poisoning, or downstream software-supply-chain claim. Scoping Questions to Ask: Ask: Was the insured's GitHub account or token used by an unauthorized party? Was code pushed to public or private repositories? Did customers, production systems, CI runners, or package consumers execute the poisoned code? Were any secrets, customer data, build artifacts, or payment systems exposed? What remediation costs are expected for token rotation, repo restoration, forensic review, customer notification, and third-party dependency review? Why It Matters: Claims severity depends on whether the event stayed inside a developer account or reached production builds, customers, third parties, or regulated data.^{[1] [5] [6] [8] [9]}

Insurance Underwriting / Risk Engineering

Turn ForceMemo into control questions for software-dependent insureds.

Audience: Insurance Underwriting / Risk Engineering Decision Ready Action: Turn ForceMemo into control questions for software-dependent insureds. Scoping Questions to Ask: Ask: Does the insured enforce branch protection, block force-pushes, require signed commits, expire and scope tokens, monitor GitHub audit logs, restrict direct GitHub installs, control IDE extensions, and limit CI runner outbound access? Are software build systems inventoried as critical assets? Why It Matters: These controls are measurable underwriting signals for developer supply-chain exposure before an incident occurs.^{[1] [4] [5] [6] [13]}

Business Owners / Leadership

Recognize GitHub and CI/CD as business-critical systems, not just engineering tools.

Audience: Business Owners / Leadership Decision Ready Action: Recognize GitHub and CI/CD as business-critical systems, not just engineering tools. Scoping Questions to Ask: Ask: Could a compromised repository reach customers, production builds, internal automation, or sensitive credentials? Who owns the risk if a trusted repo is poisoned? Why It Matters: ForceMemo shows how trusted code can become the entry point before a traditional network intrusion is visible.^{[1] [8] [9]}

Use these prompts on scoping calls, client updates, renewal conversations, and engineering triage meetings. They turn the ForceMemo story into questions a team can answer today.

GitHub accounts and tokens

Very High

Technology at Risk Item: GitHub accounts and tokens Risk Level: Very High Why It Is Exploitable: Stolen developer tokens or account access can let attackers push malicious code into every repository the account can modify.^{[1] [6] [8]}

Default branches without force-push restrictions

Very High

Technology at Risk Item: Default branches without force-push restrictions Risk Level: Very High Why It Is Exploitable: ForceMemo relied on rewriting default branch history. Branch protections reduce this exact abuse path.^{[1] [5]}

Python entry-point files: setup.py, main.py, app.py, manage.py

High

Technology at Risk Item: Python entry-point files: setup.py, main.py, app.py, manage.py Risk Level: High Why It Is Exploitable: These files are likely to run during install, testing, web app startup, or developer execution.^[1]

Direct installs from GitHub repositories

High

Technology at Risk Item: Direct installs from GitHub repositories Risk Level: High Why It Is Exploitable: A pip install from a compromised repository can execute attacker code before normal review catches the issue.^[1]

VS Code / Cursor / Open VSX extension ecosystems

High

Technology at Risk Item: VS Code / Cursor / Open VSX extension ecosystems Risk Level: High Why It Is Exploitable: Related GlassWorm reporting shows developer extensions can be used for token theft, loader delivery, and transitive compromise.^{[2] [3] [4]}

CI/CD runners with unrestricted outbound network access

Medium-High

Technology at Risk Item: CI/CD runners with unrestricted outbound network access Risk Level: Medium-High Why It Is Exploitable: StepSecurity observed anomalous Solana RPC, unknown payload server, and Node.js download traffic during controlled execution.^[1]

X / Twitter

I did not find a distinct X-sourced technical detail that added materially beyond StepSecurity and the security press. Treat X mentions as awareness signals unless they include new observable evidence.

Reddit

Reddit discussion emphasized the detection problem: no pull request trail, preserved-looking commit metadata, and uncertainty over whether ordinary CI checks are enough.^[12]

LinkedIn

LinkedIn amplification highlighted practical controls: token expiration, signed commits, branch protection, force-push monitoring, repository integrity checks, and treating IDE plugins as high-risk software.^[13]

Developer Community

Broader developer-community coverage framed ForceMemo as a stolen-credential problem that turned familiar GitHub projects into blockchain-assisted malware distribution paths. Useful signal, but not a replacement for primary technical evidence.^[14]

Tier 0

Primary technical/vendor research: StepSecurity for ForceMemo; Aikido, Koi, and Socket for related GlassWorm and developer ecosystem context.

Tier 1

Official platform documentation: GitHub controls for branch protection and token management; Solana memo documentation for blockchain memo context.

Tier 2

Recognized security media: The Hacker News and SecurityWeek summarize the campaign and broader GlassWorm connection.

Tier 3

General technology and concise secondary analysis: Tom's Hardware and ZeroDayDiary help explain the issue to broader audiences.

Tier 4

Community posts can be useful as weak signals, but this brief avoids treating social posts as primary evidence unless they add unique observable data.

ForceMemo vs GlassWorm

ForceMemo is treated as the GitHub force-push repository-poisoning wave; GlassWorm is related developer-ecosystem context and not automatically identical activity.

Issue: ForceMemo vs GlassWorm How PANDA Handles It: ForceMemo is treated as the GitHub force-push repository-poisoning wave; GlassWorm is related developer-ecosystem context and not automatically identical activity. Confidence: Medium-High^{[1] [2] [3] [4]}

Victim naming

The retained sources identify affected repositories and ecosystem risk, but this page does not convert repository exposure into named organizational victim claims without first-party disclosure.

Issue: Victim naming How PANDA Handles It: The retained sources identify affected repositories and ecosystem risk, but this page does not convert repository exposure into named organizational victim claims without first-party disclosure. Confidence: High^{[1] [8] [9]}

Community claims

Social and community posts are retained as awareness signals, not primary evidence for IOCs or victim confirmation.

Issue: Community claims How PANDA Handles It: Social and community posts are retained as awareness signals, not primary evidence for IOCs or victim confirmation. Confidence: Medium^{[12] [13] [14]}

StepSecurity

StepSecurity is a software supply-chain security company focused on GitHub Actions, CI/CD hardening, and open-source security workflows. It is Tier 0 here because its report is the primary ForceMemo-specific technical source: it identifies force-pushed GitHub repositories, Python entry points, Solana memo command-and-control, payload infrastructure, observables, and practical repository defenses.

Contributor: StepSecurity Most Valuable Contribution: StepSecurity is a software supply-chain security company focused on GitHub Actions, CI/CD hardening, and open-source security workflows. It is Tier 0 here because its report is the primary ForceMemo-specific technical source: it identifies force-pushed GitHub repositories, Python entry points, Solana memo command-and-control, payload infrastructure, observables, and practical repository defenses.^[1]

Aikido Security / Koi Security

Aikido Security and Koi Security research developer ecosystems, open-source dependencies, malicious package activity, and compromised tooling. They are valuable supporting contributors because they connect ForceMemo-adjacent GlassWorm activity to stolen credentials, invisible code, extension abuse, macOS targeting, and blockchain-backed infrastructure.

Contributor: Aikido Security / Koi Security Most Valuable Contribution: Aikido Security and Koi Security research developer ecosystems, open-source dependencies, malicious package activity, and compromised tooling. They are valuable supporting contributors because they connect ForceMemo-adjacent GlassWorm activity to stolen credentials, invisible code, extension abuse, macOS targeting, and blockchain-backed infrastructure.^{[2] [3]}

Socket

Socket is a software supply-chain security company focused on malicious open-source packages and developer dependency risk. It contributes ecosystem context on Open VSX extension abuse, extension dependency behavior, and how compromised developer tooling can become broader software-supply-chain exposure.

Contributor: Socket Most Valuable Contribution: Socket is a software supply-chain security company focused on malicious open-source packages and developer dependency risk. It contributes ecosystem context on Open VSX extension abuse, extension dependency behavior, and how compromised developer tooling can become broader software-supply-chain exposure.^[4]

These sources contributed the highest-value, most differentiated evidence used in this flash brief.

Maintainer account takeover

A familiar maintainer account can push malicious code that appears legitimate to downstream consumers.

Example: Maintainer account takeover Why It Matters: A familiar maintainer account can push malicious code that appears legitimate to downstream consumers. Action: Rotate tokens, review branch history, and require protected-branch controls.

CI runner execution

A poisoned setup.py or app.py can reach CI secrets or package-build artifacts.

Example: CI runner execution Why It Matters: A poisoned setup.py or app.py can reach CI secrets or package-build artifacts. Action: Review runner logs, egress, secrets access, and build provenance.

Developer workstation install

Direct installs or cloned repos can execute malicious Python entry points outside production telemetry.

Example: Developer workstation install Why It Matters: Direct installs or cloned repos can execute malicious Python entry points outside production telemetry. Action: Review shell history, package install logs, IDE extensions, and local clones.

Affected GitHub repositories

Repository-level exposure reported

Victim / Entity: Affected GitHub repositories Confirmed?: Repository-level exposure reported Reported / Disclosed By: StepSecurity reported hundreds of compromised Python repositories. Boundary: Do not restate as confirmed organizational breach without first-party victim disclosure.^[1]

Named organizations

Not confirmed by this source set

Victim / Entity: Named organizations Confirmed?: Not confirmed by this source set Reported / Disclosed By: No named organizational self-disclosure is retained in the current baseline. Boundary: Keep public victim rows empty until a reliable source names an organization and impact.

This page does not identify a CISA KEV entry or single CVE driving ForceMemo. Response should focus on repository integrity, account security, token rotation, force-push controls, CI/CD telemetry, and developer endpoint review.

Initial access

Stolen GitHub credentials or tokens enable repository modification.

Phase: Initial access ForceMemo Mapping: Stolen GitHub credentials or tokens enable repository modification. Defender Breakpoint: Token rotation, MFA, GitHub audit-log review, and suspicious push detection.

Execution

Poisoned Python entry points may execute during install, test, or build workflows.

Phase: Execution ForceMemo Mapping: Poisoned Python entry points may execute during install, test, or build workflows. Defender Breakpoint: Block direct untrusted installs, inspect diffs, and monitor CI egress.

Command and control

Solana memo lookups provide resilient payload instruction retrieval.

Phase: Command and control ForceMemo Mapping: Solana memo lookups provide resilient payload instruction retrieval. Defender Breakpoint: Alert on unexpected Solana RPC access from developer and CI environments.

StepSecurity

High

Source: StepSecurity Weight: High How Used: Primary ForceMemo-specific technical reporting. Limits: Single primary source; corroborate victim impact separately.

Aikido / Koi / Socket

Medium-High

Source: Aikido / Koi / Socket Weight: Medium-High How Used: Related ecosystem and GlassWorm context. Limits: Do not over-merge every related detail into ForceMemo.

Social/community sources

Low-Medium

Source: Social/community sources Weight: Low-Medium How Used: Awareness and defender-concern signals. Limits: Not used as authoritative evidence.

Related PANDA products may include developer supply-chain briefs, malicious extension snapshots, credential-theft explainers, and CI/CD hardening checklists as they are added to the vault.

Notes for analysts: keep ForceMemo-specific findings separated from broader GlassWorm context, avoid converting repository compromise into confirmed victim claims, and preserve uncertainty around whether poisoned repositories were executed or propagated downstream.

v1.2

04-Jul-2026

Version: v1.2 Date: 04-Jul-2026 Changes: Enabled ForceMemo production Page Alerts, assigned the AI Monitoring Agent, wired card-level delta email support, and added the brief to the production Page Alerts monitor target list. No source-backed ForceMemo content delta was added in this enablement update.

v1.1

29-Jun-2026

Version: v1.1 Date: 29-Jun-2026 Changes: Converted ForceMemo to the standardized PANDA FortiBleed-style reader with 32 cards, yellow pull-out drawer, locked first-visit defaults, header metadata, share/alert rail, and citation reveal behavior.

v1.0

Initial static publish

Version: v1.0 Date: Initial static publish Changes: Published the baseline ForceMemo GitHub repository poisoning and developer supply-chain risk brief.

This PANDA threat intel flash brief was generated using the IntelliOS Flash Brief template.

1

Tier 0

#: 1 Tier (Public Source Trust Level): Tier 0 Source: StepSecurity Published: March 2026 Unique Value: Primary ForceMemo reporting: account takeover, force-push injection, Python file targets, Solana memo C2, payload infrastructure, IOCs, timeline, and defensive observations. Link: ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push

2

Tier 0

#: 2 Tier (Public Source Trust Level): Tier 0 Source: Aikido Security Published: March 2026 Unique Value: Related GlassWorm reporting on invisible Unicode payloads, GitHub repository compromise, npm and VS Code ecosystem targeting, and shared Solana C2 context. Link: Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Hundreds of Repositories

3

Tier 0

#: 3 Tier (Public Source Trust Level): Tier 0 Source: Koi Security Published: February 2026 Unique Value: Related GlassWorm campaign evolution: macOS targeting, Solana memo infrastructure, AES-wrapped payloads, and developer-focused credential theft. Link: GlassWorm Goes Mac: Fresh Infrastructure, New Tricks

4

Tier 0

#: 4 Tier (Public Source Trust Level): Tier 0 Source: Socket Published: March 13, 2026 Unique Value: Developer extension ecosystem context: Open VSX transitive dependency abuse, extensionPack/extensionDependencies risk, Solana memo lookups, and developer endpoint exposure. Link: 72 Malicious Open VSX Extensions Linked to GlassWorm Campaign

5

Tier 1

#: 5 Tier (Public Source Trust Level): Tier 1 Source: GitHub Docs Published: Continuously updated documentation Unique Value: Official GitHub control guidance for branch protection, required reviews, and restricting force-pushes to default branches. Link: About protected branches

6

Tier 1

#: 6 Tier (Public Source Trust Level): Tier 1 Source: GitHub Docs Published: Continuously updated documentation Unique Value: Official GitHub token guidance relevant to personal access token scope, rotation, minimization, and revocation. Link: Managing your personal access tokens

7

Tier 1

#: 7 Tier (Public Source Trust Level): Tier 1 Source: Solana Program Library Published: Repository documentation Unique Value: Technical context for the Solana memo mechanism abused as a resilient instruction channel in the ForceMemo/GlassWorm tradecraft. Link: Solana Memo Program

8

Tier 2

#: 8 Tier (Public Source Trust Level): Tier 2 Source: The Hacker News Published: March 2026 Unique Value: Trade-press synthesis connecting stolen GitHub tokens, force-pushed malware, Python repositories, and GlassWorm expansion. Link: GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos

9

Tier 2

#: 9 Tier (Public Source Trust Level): Tier 2 Source: SecurityWeek Published: March 2026 Unique Value: Independent trade-press coverage summarizing account-level compromise, stealthy force-push behavior, and the GlassWorm connection. Link: ForceMemo: Python Repositories Compromised in GlassWorm Aftermath

10

Tier 3

#: 10 Tier (Public Source Trust Level): Tier 3 Source: Tom's Hardware Published: March 14, 2026 Unique Value: General technology coverage explaining invisible Unicode abuse and why repository reviewers may miss hidden payloads. Link: Invisible malicious code attacks 151 GitHub repos and VS Code

11

Tier 3

#: 11 Tier (Public Source Trust Level): Tier 3 Source: ZeroDayDiary Published: March 2026 Unique Value: Concise secondary analysis framing ForceMemo as token theft plus trusted-code poisoning rather than ordinary endpoint malware. Link: GlassWorm ForceMemo campaign shows how stolen GitHub tokens can silently poison Python repos

12

Tier 4

#: 12 Tier (Public Source Trust Level): Tier 4 Source: Reddit / r/TechNadu Published: March 2026 Unique Value: Community discussion focused less on new IOCs and more on practical detection anxiety: no PR trail, preserved metadata, and whether CI checks or code review are enough. Link: GlassWorm campaign is force-pushing malware into GitHub repos — how do you even detect this?

13

Tier 4

#: 13 Tier (Public Source Trust Level): Tier 4 Source: LinkedIn / The Hacker News Published: March 2026 Unique Value: Social amplification of defensive takeaways: token expiration and scoping, signed commits, branch protection, force-push monitoring, repository integrity checks, and treating IDE plugins as high-risk software. Link: Attackers are hijacking GitHub accounts and silently planting malware in Python repos

14

Tier 4

#: 14 Tier (Public Source Trust Level): Tier 4 Source: DEV Community Published: March 2026 Unique Value: Developer-community coverage that reinforces the practical framing: stolen credentials converted familiar GitHub projects into blockchain-assisted malware distribution paths. Link: ForceMemo: How Stolen Credentials Turned Hundreds of GitHub Python Repos Into Blockchain-Powered Malware Distributors