A campaign first flagged in March 2026 involving malicious obfuscated JavaScript payloads in hundreds of GitHub repositories. It has compromised over 1,900 repositories and uses techniques like Git history rewriting and VS Code task files to deliver BeaverTail malware.