A shady GitHub repo from this account Retro-007 (https://github.com/Retro-007) appeared with a bizarre Shai-Hulud-like description, matching the odd random-repo pattern we saw during the “Second Coming” attack. Even weirder, the repo has a commit by Linus Torvalds (https://github.com/Retro-007/shopbook/commit/99c9ba5e78437ffeea99355439d6d04d470a8eda) that looks at a glance like his account was hacked.

This pattern can be seen in dozens of other repos with the description "F*K Guillermo, F*K VERCEL --multi"

But, in fact, the commit is forged Git metadata, a known trick where an attacker can fake any GitHub user without having access to the real one, the same ecosystem weakness behind the Shai-Hulud attacks.

I've written about the start of these weird encounters in the past week till now on this in https://sitezwin.com/posts/2025-11-29-sha-hulud-the-second-coming-encouter