GitHub dismissed security reports on flaws now exploited by supply-chain worm, researchers say

A supply-chain worm, dubbed Shai-Hulud, is exploiting design flaws in GitHub to infect hundreds of software packages and developer accounts worldwide. The vulnerabilities, initially flagged by Deep Specter Research, were dismissed by GitHub as ineligible, allowing the TeamPCP cybercrime group and copycat entities to compromise systems including the European Commission, Mercor, and Red Hat. The situation highlights concerns about GitHub's vulnerability reporting process and the broader security landscape surrounding open-source software.