# Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter

Compromised maintainer account force-pushed a Shai-Hulud credential stealer into gpt-pilot's main branch; ruff lint failures blocked both attempts.

- Payout: Real-world hack
- Severity: critical
- Program: Pythagora gpt-pilot
- Analysis by: StepSecurity
- Disclosed: 2026-06-09
- Write-up quality: 8/10
- Original: https://www.stepsecurity.io/blog/pythagora-io-gpt-pilot-compromised-on-github-shai-hulud-credential-stealer-blocked-by-python-linter
- Library page: https://bugbountylibrary.com/r/blog%3Astepsecurity-io-blog-pythagora-io-gpt-pilot-compromised-on-github-shai-hulud-credential-stealer-blocked-by-python-linter
- Tags: area:oss domain:oss impact:data-leak impact:integrity kind:incident platform:threat-intel sev:critical tech:github-actions tech:python technique:recon technique:source-review vuln:secrets-leak

**Target:** GitHub repository main branch / Python package core/telemetry
**Root cause:** No branch protection on main let a compromised co-founder account force-push a backdated trojan commit adding a Python loader that spawns a daemon thread on import to run an obfuscated Bun JavaScript credential stealer.
**Steps:**
1. Compromise LeonOstrez GitHub account (co-founder/maintainer).
2. Force-push to main replacing clean chain `53154df1c66b` with malicious `90f59f5de681` (no branch protection).
3. Inject backdated 'Revert' commit `065ee8eb` adding `core/telemetry/_hooks.py`, `_runtime.bin`, and +9 lines in `__init__.py`.
4. `__init__.py` line 399 spawns `_th.Thread(target=_setup_reporting, daemon=True).start()` on module import.
5. `_hooks.py` downloads Bun v1.3.13 and executes `_runtime.bin` (758KB obfuscated JS).
6. Payload harvests AWS/npm/GitHub/K8s/Vault/SSH creds, C2 via `GET https://api.github.com/search/commits?q=thebeautifulsnadsoftime`, exfil via new GitHub repos and DNS+AES-256-GCM.
7. CI ruff `format --check` fails on `_hooks.py` line 59; retry fails `ruff check` E402/I001 on `__init__.py` line 399.
**How found:** StepSecurity noticed force-push events rewriting main history, compared clean vs malicious 'Revert' commits with identical metadata, and traced CI failures to ruff format/lint violations in the injected files.
**Exploitation:** Attacker with stolen maintainer token force-pushed directly to main; any developer installing/pulling gpt-pilot after 11:01 UTC would import telemetry, triggering the loader to fetch Bun and run the stealer, exfiltrating cloud/CI credentials and planting Claude Code/VS Code persistence hooks. Blocked before merge by CI lint failures.
**Escalation:** Stolen npm tokens + Sigstore/Fulcio abuse to publish malicious packages with valid SLSA Build L3 attestations; persistence via .claude/settings.json and .vscode/tasks.json hooks.
**Insight:** Malicious code injected outside normal dev workflow often violates project formatting/lint rules — mandatory `ruff format --check` and `ruff check` in CI act as a cheap supply-chain tripwire; also watch for backdated commits with duplicated metadata and force-pushes to default branches.