forcememo-python-repos

Incident Summary

ForceMemo GitHub Python repository force-push campaign

ForceMemo was a GitHub account-takeover campaign that force-pushed similar malware into hundreds of Python repositories across Django apps, ML research, Streamlit dashboards, Flask APIs, and projects installed directly from GitHub. The attacker preserved legitimate commit authorship and messages while appending an obfuscated Python loader to common entry points. The malware used the shared marker lzcdrtfxyqiplpd, avoided Russian/CIS systems, and pulled encrypted follow-on instructions through a Solana memo wallet. This grouped record captures the campaign because the affected set was a moving GitHub code-search population rather than a stable package list.

Date: 2026-03-08 to 2026-03-14
Category: Open Source
Target Surface: Revision control
Insertion Phase: source
Impact: Credential theft
Cause: Compromised Account/Credentials