Attribution Broadens Case

Security firms and government agencies connect the 61,000-repository campaign to earlier 2026 credential-theft activity targeting GitHub, LiteLLM, and exposed API keys. The main uncertainty is whether the actors are financially motivated criminals or a state-linked group conducting broader reconnaissance.

Each figure is the modeled move of the S&P 500 if the outcome occurs. For information only. Not investment advice.