🧰 GitHub API

The items that name it 7

• alex lee (@alexlee20122022) on X
  thread2026-10-25It is written here as GitHub API: used by the attacker to fetch the run log.
• A fully programmable secure web gateway
  article2026-10-15

  Queried by a DLP validation Worker to check whether a detected token is active.

• Tensorlake npm package compromised by Shai-Hulud in latest software supply chain attack | Blog | Endor Labs
  advisory2026-10-08

  Abused by the payload for credential checks, repository creation, and spreading the worm

• Show HN: MailAccess – the true Email OSINT framework
  tool2026-10-06It is written here as github_api.

  Source module used by MailAccess to corroborate account findings (e.g., GitHub account matches)

• Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime | Blog | Endor Labs
  writeup2026-09-11

  Used by the malware (instead of a traditional C2 endpoint) to commit and push files containing stolen credentials

• PolinRider Confirmed Footprint Grows 6.5x Since March
  writeup2026-07-15

  Used in the hunt to discover compromised repositories; noted as having pagination limits that cause undercounting

• Socket: Mini Shai-Hulud Hits @antv Ecosystem
  writeup2026-05-20

  Abused by the payload for fallback exfiltration by creating repositories and committing stolen data under results/ directories