Repeated payload markers, new repositories created from compromised accounts, and searchable credential-dump artefacts are the clearest signs. If infected settings files, linked repos, or exfiltrated JSON dumps remain publicly accessible after takedown, the campaign is still propagating through residual trust paths.
What makes a repository-based worm “still active”?
A repository-based worm is still active when it continues to leave observable traces of propagation rather than only historic damage. The clearest indicators are repeated payload markers, new repositories created from compromised accounts, and searchable credential-dump artefacts. Persistence usually means the worm still has reachable trust paths, such as infected settings files, linked repositories, or exposed dumps that can be rediscovered and reused.
In practice, the question is not whether one infected repo was cleaned up, but whether the campaign can still spread through residual trust relationships and stale artefacts. When those paths remain public or re-creatable, the worm may still be operational even if the original entry point has been contained.
Which signs matter most in live triage?
The strongest sign is repeated payload structure across multiple repositories or accounts, because that suggests the same automation is still executing, not just one-off contamination. A second sign is repository creation or modification from compromised accounts, especially when the commit history or metadata shows unnatural timing, duplicated content, or sudden fan-out across related projects.
Searchable credential-dump artefacts are equally important because they show the worm is not only planting code, but also harvesting or exposing material that can be reused for the next wave of compromise. If the artefacts are easy to index, fork, clone, or reference from other repos, the propagation loop may still be intact.
Residual accessibility is a key discriminator. If infected settings files, linked repos, or exfiltrated JSON dumps remain publicly reachable after takedown, you should treat the campaign as still active until those pathways stop producing new infections or new exposures.
How do you tell active propagation from leftover noise?
Look for freshness, repetition, and reach. Fresh activity usually appears as new repository events, new payload variants, or repeated creation of similar malicious artefacts after prior cleanup. Leftover noise tends to be static, single-instance, and no longer linked to any new account abuse or repository creation.
It also helps to separate the payload from the propagation mechanism. A dormant malicious file may remain in a repository without meaning the worm is still spreading; by contrast, a live worm usually preserves the machinery that finds trust paths, copies itself, or reuses stolen data to bootstrap the next infection. That is why linked repositories and publicly accessible JSON dumps are so important to inspect, not just delete.
Risk and Threat Considerations
A repository-based worm stays dangerous as long as it can keep converting trust into reach. The main risk is not just code persistence, but the combination of public artefacts, reusable credentials, and linked repositories that allow the campaign to regenerate after partial cleanup.
Failure mechanism: The worm exploits inherited trust between repositories, accounts, settings files, and exposed dumps, then uses that residual access to create new artefacts or repos faster than defenders can remove them.
Impact: Organisations can see repeated compromise, wider credential exposure, and continued propagation across projects even after an initial takedown, which turns one incident into an ongoing containment problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1583 — Acquire Infrastructure | Repository worms rely on repeatable infrastructure and account abuse to spread. |
| Recommendation — Map new repo creation and reused artefacts to infrastructure staging patterns in detection. | ||
| CIS Controls v8 | CIS-5 — Account Management | Compromised accounts are the propagation vehicle for new repositories and artefacts. |
| Recommendation — Review and disable compromised accounts, then verify no residual access remains. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Live propagation is confirmed by analysing repeated payloads and post-cleanup activity. |
| AC-6 — Least Privilege | Residual trust paths exploit excessive access across linked repositories and settings. | |
| Recommendation — Correlate repo events and artefact reuse to confirm the worm is still active. Reduce cross-repo access to limit worm spread through inherited trust. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Searchable credential-dump artefacts indicate exposed secrets still enabling spread. |
| Recommendation — Rotate leaked secrets and remove public artefacts that can be rediscovered. | ||
Practitioner Guidance
What to verify: Confirm whether any new repositories, payload markers, or credential-dump artefacts appeared after the initial response window. If the answer is yes, assume the propagation path is still live until you can prove otherwise with clean scans and no fresh fan-out.
What to prioritise: Remove or invalidate the reusable trust path before focusing on cosmetic cleanup. In this scenario, that means the exposed settings, links, tokens, and public artefacts that allow re-infection, not just the visible malicious files.
What good looks like: No new repo creation from affected accounts, no new payload reuse, and no public artefacts that can be discovered and leveraged by the same mechanism. A campaign is only convincingly contained when the propagation loop has stopped, not merely when the first infected repository has been taken down.
Practitioner takeaway: Treat repeated payloads plus fresh repository creation as the strongest sign of active propagation, and treat any remaining public credential or JSON artefact as a live re-entry point until it is proven inert.
Related resources from NHI Mgmt Group
- Why do still-valid secrets matter after public disclosure?
- What are the signs that an attacker is still active after a password or MFA reset?
- What are the signs that a checkout skimmer is still active in a WordPress environment?
- What are the signs that credential-based access is being abused inside a cloud or document repository?