GlassWorm Malware Campaign Exploits Stolen GitHub Tokens to Infect Python Repositories Security researchers at StepSecurity have uncovered an active malware campaign, dubbed GlassWorm, which is leveraging stolen GitHub tokens to inject malicious code into a wide range of Python repositories. The attack targets core project files including setup.py, main.py, and app.py across multiple Python ecosystems, such as Django applications, machine learning research code, Streamlit dashboards, and packages on the Python Package Index (PyPI). The campaign employs obfuscation techniques to evade detection, making it difficult for developers and security teams to identify compromised code. Once executed, the injected payload can enable remote access, facilitate data exfiltration, or further propagate the infection within connected networks and systems. Given Python’s widespread use in web development, data analytics, and scientific research, the attack poses significant risks to the integrity and security of applications built on these repositories. The primary entry point stolen GitHub tokens highlights the growing threat of supply chain attacks, where attackers exploit weak authentication controls to compromise trusted codebases. StepSecurity has confirmed the campaign’s ongoing activity, emphasizing the need for heightened vigilance in token management and code review processes to mitigate further exposure.

A critical vulnerability in Streamlit's st.file_uploader component allowed attackers to bypass file type restrictions and gain unauthorized access to cloud instances running Streamlit applications. This flaw enabled cloud account takeovers, financial data tampering, and potential manipulation of stock market dashboards, leading to cascading effects such as automated trading system responses to false signals and investor decisions based on fraudulent trends. The vulnerability was patched in version 1.43.2, but the exposure posed significant risks to financial institutions and other organizations relying on Streamlit for data applications.