Poisoned Pipeline / Incidents / AS217
ForceMemo force-pushed Python malware
Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.
Mapped techniques
- T0109 Publish malicious artifact
supply-chain campaign
Named in the tstromberg supplychain-attack-data corpus with first-party references.
Sources
- https://www.stepsecurity.io/blog/forcememo-hundreds-of-github-python-repos-compromised-via-account-takeover-and-force-push
- https://cybersecuritynews.com/forcememo-hijacks-github-accounts/
- https://github.com/watercrawl/watercrawl-py/commit/16f7797f15a75d632e55d03af07a31d4336a88db
- https://data.gharchive.org/2026-03-10-21.json.gz