A flaw in GitHub’s CDN (Content Delivery Network) enables attackers to upload malware into comments on GitHub repositories. The flaw was discovered after researchers noted that a new LUA malware loader was being distributed through URLs to Microsoft’s GitHub repository for vcpkg and the STL library. However, references to the malware were not actually found on Microsoft’s live repository, leading Bleeping Computer to discover that the GitHub URL hosting the malware must have been generated by exploiting a flaw in GitHub’s CDN design. The flaw in the design is that GitHub automatically generates a download link after a file is added to a comment on a repository, which is then available via Github’s CDN. Even when the comment is not posted, or deleted after posting, the files are not deleted from the CDN and the download URLs continue to be accessible. This flaw is an effective vehicle for attackers looking to spread malware through seemingly legitimate links. Researchers have seen this being abused on Microsoft’s repository as well as a known aimbot game cheat software repository. While the LUA malware loader has been observed to be distributed through this flaw, ostensibly any malware or unwanted content can be associated with legitimate repositories by uploading files to unsaved comments. To mitigate this abuse, it is possible for developers to temporarily disable comments for maximum of six months at a time, however this is often not a viable route for development projects. At time of this writing, Bleeping Computer has not received a response from GitHub after disclosing the finding to the company on Thursday, March 18th. CTIX analysts will continue to report on novel and evolving malware campaigns.