Nearly 300 GitHub repos pose as legit software to push malware

Multiple July 14, 2026 security stories: a threat actor published nearly 300 fake GitHub repositories impersonating legitimate projects to distribute infostealer malware, while a malicious version of the Jscrambler npm package and a new macOS infostealer named CrashStealer were also observed — highlighting active supply-chain and commodity infostealer campaigns. Two new phishing kits (Jalisco, OmegaLord) that evade MFA and ongoing phishing targeting LastPass/Bitwarden were reported. Microsoft shipped its July 2026 Patch Tuesday (record ~570 flaws, including three zero-days and one publicly-dis