Oct 8, 2026, 4:20 PMAre you in Incident Response? You may want to review your malware response plans.
"When the malware has a GitHub token, it installs a small service called gh-token-monitor. Every 60 seconds, for up to 24 hours, the service checks that token against the GitHub API. If GitHub rejects it, the service runs rm -rf ~/ (or a PowerShell delete of your user profile on Windows). So the obvious first move, revoking the token, is what sets it off."
https://ifin.network/t/tensorlake-supply-chain-attack-comes-with-booby-trap/890
