ForceMemo force-pushed Python malware

Beginning on March 8, 2026, an attacker quietly force-pushed obfuscated Python malware into the default branches of more than 240 GitHub repositories belonging to dozens of unrelated developers, mostly Django apps, machine-learning research code, Streamlit dashboards, and small Flask APIs that downstream users tended to install straight from a git URL. StepSecurity, which first reported the campaign on March 14, named it ForceMemo for its delivery mechanism and its command channel.

The injection was designed to defeat a casual git log review. The attacker took the most recent legitimate commit on each repository, kept its message, author, and author date, then rebased it with a malicious tail appended to a likely entry point such as setup.py, main.py, or app.py, and force-pushed the result. Only the committer date and a glance at the bottom of the file would betray the rewrite.

The appended Python was wrapped in base64, zlib, and an XOR layer, all organized around a shared marker variable named lzcdrtfxyqiplpd (still a useful GitHub code search string). Once decoded, the loader queried transaction memos on a Solana wallet, BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC, for command instructions, downloaded Node.js v22.9.0 when it needed a runtime, fetched encrypted JavaScript stages, and dropped ~/init.json as a two-day persistence marker.

StepSecurity tied the account-takeover path back to GlassWorm, the credential-stealing malware shipped through poisoned VS Code and Cursor extensions in the preceding weeks. The two campaigns used different injection techniques but shared the same Solana wallet for command and control, evidence that the same operator was behind both. This record covers the Python repository delivery path; the GlassWorm campaign as a whole is tracked separately.

Motive

Credential Theft Wallet Key Theft

Cause

Compromised Account Credentials

Transitive

No

• ForceMemo compromised hundreds of GitHub Python repos via account takeover and force-pushstepsecurity.io