Your home directory got deleted? Don’t look for an intruder. It may have been your own hand

Have you ever thought about coming back to your machine and finding files gone from your repository, or in the worst case the whole repository gone? That does not take anyone breaking into GitHub. A worm living on your own machine can do it, and its name is testmetest. The way it deletes is unusual: it is in no hurry to delete anything itself. It waits for you. The second you find a token stolen and press revoke, it wipes the home directory on your computer.

What exactly gets deleted? Not the repository on GitHub’s site. That was not deleted in this campaign. What gets wiped is the home directory on your computer, and most developers keep their repository clones in their home directory, along with work they have not pushed yet, their SSH keys and their .env files. When the home directory goes, all of that goes with it.…