GITHUB · CMP-202611-cyizpm · Other
NO FIX YET · SEE WHAT TO DO
MalwareHunterTeam reported on 10 Nov 2026 a malware sample whose code calls itself a 'Dev Toolkit - Background Service' ('Configuration sync and telemetry service') but has C2 and victim handling, steals the victim's GitHub token and has an 'Auto-spread' option that pushes itself into the victim's GitHub repos with that token. Two web panels titled 'C2' were found on port 3000. A related sample was uploaded to MalwareBazaar by @smica83. How it reaches victims (npm or other package, extension, fake repo), the platforms it runs on, and confirmed victims are unknown so far.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Dev Toolkit - Background Service or Configuration sync and telemetry serviceDev Toolkit service: isolate it, revoke and reissue its GitHub tokens (PATs, gh CLI, OAuth) and other credentials on it, and review recent pushes to every repo that account can write toCheck it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.