Someone’s poisoning proof-of-concept exploits on GitHub to infect security researchers. The malware’s called ChocoPoC — a Python-based remote access trojan that can steal data and run commands.
Here’s the clever part. The malware doesn’t sit in the exploit code itself. It hides in the project’s dependencies. When a researcher clones a malicious repo, a package called ‘frint’ gets pulled from PyPI automatically. That pulls ‘skytext’ — a compiled Python extension that decrypts and runs a downloader. The downloader fetches ChocoPoC from a Mapbox dataset.
ChocoPoC can execute shell commands, upload files, steal browser passwords and cookies, scrape markdown docs and database files, grab shell history, and map network configs. Data exfiltration goes through Mapbox datasets or a separate HTTP server for bigger files.
Sekoia found at least seven malicious repos. They host exploits for FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page Builder (CVE-2026-48908).
Skytext was downloaded 2,400 times, mostly on Linux. Downloads spiked every time a hot new vulnerability dropped.
The attackers used compromised accounts — credentials found in leak databases. Sekoia says with high confidence that stolen accounts published the malicious packages and repos.
The warning is blunt: if you’re a researcher, don’t blindly trust GitHub repos. Run untested code in isolated environments only.
