If you’ve been scrolling through the infosec corners of Twitter (X) or monitoring threat feeds lately, you’ve probably seen a spike in searches for “Mega Rat Pack GitHub.”

Stay safe, and always audit your dependencies. Have you stumbled across a suspicious repo claiming to be a "crack" or "tool"? Report it to GitHub Security Lab immediately.

Here is what you need to know about this campaign, how the "RATs" work, and why your morning git clone just got a lot riskier. The "Mega Rat Pack" isn't a single piece of software. It is a massive, decentralized campaign involving hundreds (potentially thousands) of fake GitHub accounts.

It sounds like a 90s arcade villain or a punk band, but in reality, it is the nickname security researchers have given to a prolific, automated wave of malicious repositories flooding Microsoft’s code hosting platform.

Open source is powerful, but it relies on trust. The Mega Rat Pack is burning that trust for short-term crypto gains. Treat every git clone like you would treat a USB stick found in a parking lot—with extreme prejudice.