GitHub said in its Octoverse report on October 28 that Pull Requests merged over the past twelve months reached 1.3 billion, averaging 3.5 million per day, three times the figure for the same period last year. More than 40% of Pull Requests begin with an agent-drafted opening, compared with 17% in March 2026; projects containing an AGENTS.md file receive eight times as many commits as projects without such a file. TypeScript and Python each have about 13 million monthly contributors, tying as the most popular languages, with JavaScript close behind at 7.4 million; platform users grew to 225 million, with Germany ranking eighth at 6.3 million.
GitHub said in its Octoverse report on October 28 that Pull Requests merged over the past twelve months reached 1.3 billion, averaging 3.5 million per day, three times the figure for the same period last year. More than 40% of Pull Requests begin with an agent-drafted opening, compared with 17% in March 2026; projects containing an AGENTS.md file receive eight times as many commits as projects without such a file. TypeScript and Python each have about 13 million monthly contributors, tying as th
The JFrog security research team found that 42 GitHub repositories were implanted with execution hooks and hidden malicious code, and classified them under the npm worm campaign testmetest. These repositories belong to 11 legitimate owners, and attackers injected code through stolen accounts or employee permissions; when users launch Claude Code, Gemini, or Cursor in a project, or open a VS Code workspace with the corresponding settings, the related configuration may execute the hidden file .github/init.js. JFrog listed 15 npm packages with at least one version judged malicious, and recommended checking affected systems, reviewing repository configurations and workflows, and revoking potentially leaked credentials; SafeDep said the worm installs a wiper that deletes the victim's home directory when the victim revokes the stolen GitHub token.
The JFrog security research team found that 42 GitHub repositories were implanted with execution hooks and hidden malicious code, and classified them under the npm worm campaign testmetest. These repositories belong to 11 legitimate owners, and attackers injected code through stolen accounts or employee permissions; when users launch Claude Code, Gemini, or Cursor in a project, or open a VS Code workspace with the corresponding settings, the related configuration may execute the hidden file .git
In the Octoverse 2026 report, GitHub announced that in 2026 merged pull requests rose to 220 million per month in less than a year, commits rose to 7.38 billion per month, and the rate of new repository creation doubled to 30.3 million per month. The report also tallies repository data by industry, and separately counts public repositories whose names, descriptions, topics, or READMEs involve interoperability or reverse engineering. The methodology section explains that for country rankings, an LLM extracts ISO 3166-1 alpha-2 codes from user profiles to correct for VPN bias, while for industry classification, a fine-tuned multilingual embedding model is used to categorize public repositories created between 2022 and 2026 according to NAICS.
In the Octoverse 2026 report, GitHub announced that in 2026 merged pull requests rose to 220 million per month in less than a year, commits rose to 7.38 billion per month, and the rate of new repository creation doubled to 30.3 million per month. The report also tallies repository data by industry, and separately counts public repositories whose names, descriptions, topics, or READMEs involve interoperability or reverse engineering. The methodology section explains that for country rankings, an
JFrog's security research team discovered 42 GitHub repositories implanted with execution hooks and hidden malicious code, and classified them under the npm worm campaign testmetest. These repositories belong to 11 legitimate owners, and attackers injected code through stolen accounts or employee permissions. When users launch Claude Code, Gemini, or Cursor in a project, or open a VS Code workspace with the corresponding settings, the related configuration may execute the hidden file .github/init.js. JFrog listed 15 npm packages with at least one version judged malicious, and recommended checking affected systems, reviewing repository configurations and workflows, and revoking potentially leaked credentials; SafeDep said the worm installs a wiper that deletes the victim's home directory when the victim revokes the stolen GitHub token.
GitHub released the Octoverse report on October 28. The report states that 1.3 billion pull requests were merged over the past twelve months, averaging 3.5 million per day, triple the figure for the same period last year; more than 40% of pull requests began with an agent-drafted opening, compared with 17% in March 2026; projects containing an AGENTS.md file received eight times as many commits as projects without such a file. TypeScript and Python each have about 13 million monthly contributors, tying as the most popular languages, with JavaScript close behind at 7.4 million; platform users grew to 225 million, with Germany ranking eighth at 6.3 million. Another report states that the report disclosed that merged pull requests grew to 220 million per month in less than a year, commits grew to 7.38 billion per month, and the rate of new repository creation doubled to 30.3 million per month.
GitHub released the Octoverse report on October 28. The report states that 1.3 billion pull requests were merged over the past twelve months, averaging 3.5 million per day, triple the figure for the same period last year; more than 40% of pull requests began with an agent-drafted opening, compared with 17% in March 2026; projects containing an AGENTS.md file received eight times as many commits as projects without such a file. TypeScript and Python each have about 13 million monthly contributors
GitHub released the Octoverse report on October 28. The report states that 1.3 billion pull requests were merged over the past twelve months, averaging 3.5 million per day, triple the figure for the same period last year; more than 40% of pull requests began with an agent-drafted opening, compared with 17% in March 2026; projects containing an AGENTS.md file received eight times as many commits as projects without such a file. TypeScript and Python each have about 13 million monthly contributors, tying as the most popular languages, with JavaScript close behind at 7.4 million; platform users grew to 225 million, with Germany ranking eighth at 6.3 million. Another report states that the report disclosed that merged pull requests grew to 220 million per month in less than a year, commits grew to 7.38 billion per month, and the rate of new repository creation doubled to 30.3 million per month.
JFrog's security research team discovered 42 GitHub repositories implanted with execution hooks and hidden malicious code, and classified them under the npm worm campaign testmetest. These repositories belong to 11 legitimate owners, and attackers injected code through stolen accounts or employee permissions. When users launch Claude Code, Gemini, or Cursor in a project, or open a VS Code workspace with the corresponding settings, the related configuration may execute the hidden file .github/init.js. JFrog listed 15 npm packages with at least one version judged malicious, and recommended checking affected systems, reviewing repository configurations and workflows, and revoking potentially leaked credentials; SafeDep said the worm installs a wiper that deletes the victim's home directory when the victim revokes the stolen GitHub token.
JFrog's security research team discovered 42 GitHub repositories implanted with execution hooks and hidden malicious code, and classified them under the npm worm campaign testmetest. These repositories belong to 11 legitimate owners, and attackers injected code through stolen accounts or employee permissions. When users launch Claude Code, Gemini, or Cursor in a project, or open a VS Code workspace with the corresponding settings, the related configuration may execute the hidden file .github/ini