The Gate Nobody Will Build

A platform that hosts other people’s code cannot certify which of it is poisoned. It can certify who published it — and that is the gate it actually built.

The most dangerous line in a repository is rarely the one with the exploit in it. It is the line you never scrolled to — the one that runs off the right edge of the editor, or hides inside a file whose size does not match its length. A repository does not need a vulnerability to hurt you. It needs your trust in the place where you found it.

That trust is not irrational. It is the product. GitHub became the largest code host in the world by making other people’s work feel finished, reviewed and safe to reuse; Microsoft paid 7.5 billion dollars for that position in 2018 [2]. A position like that carries an awkward obligation, because the distribution platform is the only party with enough visibility to say what the code actually does. On that question it has decided, in writing, not to answer. On a different question it moved within eight days of a worm.

The policy says the quiet part out loud

GitHub’s acceptable-use policy on active malware is unusually candid. It forbids using the platform “in direct support of unlawful attacks that cause technical harms”, then narrows the promise immediately: “GitHub allows dual-use content and supports the posting of content that is used for research into vulnerabilities, malware, or exploits”, adding that “We assume positive intention” [1]. Intervention is described as something reserved for “rare cases of very widespread abuse”, where restriction is “temporary where feasible” and does “not serve the purpose of purging” the content [1].

Read that as a product decision rather than legal boilerplate and it becomes precise: for repositories, the platform has committed to hosting material it cannot classify, to treating intent as a default rather than a finding, and to reacting only once abuse is already widespread.

But the policy draws a line inside itself, and it matters for everything that follows. Its final line reads: “GitHub considers the npm registry to be a platform used primarily for installation and run-time use of code, and not for research.” [1] The leniency is written for repositories — places where exploit code has educational value. The registry is treated as a distribution channel, and there the standard is stricter. That is exactly where the platform’s real intervention landed.

Two gates, not one

After the Shai-Hulud worm republished infected versions of popular npm packages through compromised maintainer accounts in September 2025 [4], GitHub did two different things, and the difference is the whole argument.

It reacted to content: more than 500 compromised packages removed, and npm began blocking uploads “containing the malware’s IoCs”, which cut off the self-replicating pattern. It announced, eight days after being notified, a change to the identity layer — required two-factor authentication for local publishing, granular tokens with a short capped lifetime, deprecation of classic tokens and of TOTP in favour of FIDO-based second factors, and a push toward trusted publishing tied to a build process rather than to a person. The announcement describes a staged rollout “in the near future”, not a finished switch [3].

That second list is a gate. It is real, it does not judge a single line of code, and it answers a question that has a checkable answer: who published this, from where, through which build. Trusted publishing binds an artefact to a pipeline instead of to an account — proof of origin, not proof of intent. The gate that would answer the other question has no such property, which is why a decade of “why doesn’t GitHub just scan it” has produced no such gate.

What remains is the reactive layer, and it is competent. Secret scanning watches for committed credentials before they can be used [6]; the advisory database collects and publishes what is already known in a machine-readable format the industry consumes [5]. Both are records of the past. Neither looks at a repository and says what it will do.

Why the content gate stays unbuilt

Detection is cheap; verdicts are not. A rule that flags “a decoder followed by an execution call” takes an afternoon. What comes next is expensive: marking a repository malicious is a public statement about a named person’s work, and being wrong destroys a reputation with a database write. A “clean” verdict is worse — a warranty, issued at industrial scale, for code the platform did not write and cannot fully read.

Intent is not a property of a file. Obfuscation is a legitimate engineering practice. Generated code looks machine-written because it is. One line eight thousand characters long is a hostile trick in one repository and a compiled configuration table in the next. Any rule fine enough to catch the first will flag the second; the difference is context, context is judgement, and judgement does not batch. The xz backdoor was carried in release tarballs and found by a developer who noticed an inexplicable CPU spike, not by a scanner [7].

Even a warning is a verdict. The obvious compromise — display form-level signals without ever saying “malicious” — runs into a legal fact before a technical one: showing a warning demonstrates knowledge. Whether that knowledge creates a duty to act depends on the jurisdiction, and the answer differs between the European hosting-liability framework and United States law; but either way the platform has inherited a question it did not have before. At scale, readers collapse the distinction anyway: a warning badge is read as “avoid” or as “they told me”, and both readings are worse for the platform than silence.

Every published rule is a test suite. This objection is usually overstated, and honesty requires saying why. Signature-based antivirus and public vulnerability feeds have worked for decades despite publishing their rules, because they operate at the edge: cheap, per-machine, allowed to be wrong often, and useful precisely because they cover the long tail rather than a motivated adversary. A platform operates under the opposite constraints — one decision, one banner, one lawsuit, one attacker who can iterate against a rule that thousands of defenders depend on. The asymmetry is not about secrecy. It is about where a false positive lands.

And removal destroys the observation. A repository that disappears cannot be watched. Blocking pushes attackers toward self-hosted infrastructure, where researchers lose the visibility that made the last campaign legible at all.

What can be measured without a verdict

If the platform will not judge, judgement moves to the edge, and it moves as evidence rather than conclusion. Five things are cheap, deterministic and honest: whether a file’s size is proportionate to its line count; whether a line extends far beyond any reasonable width; whether a file carries invisible control characters of the kind used to disguise identifiers; whether the artefacts you load execute code on open rather than merely describing data; and whether the code you have is still the code that was published — a commit hash and an integrity check answer a question no pattern ever will.

That list is short on purpose. Every item reports a form, never an intention. None of them can certify a repository; together they make the first minute of reading cheaper, which is all a defensive measure at the edge can honestly promise. And the fact that these five could be displayed by a platform without any verdict is exactly the point: the missing gate is not missing because it is impossible to compute. It is missing because someone has to own the sentence that comes after the computation.

The scarce resource

The previous piece in this series ended on a sentence worth repeating: vulnerability matching is necessary and not sufficient. It tells you what is known to be broken; it does not tell you what has been deliberately poisoned. The uncomfortable addition is this: the missing half cannot be bought as a service, and it cannot be worn as a badge — because the moment it becomes a product, it becomes a map, and a map of your weaknesses is the thing an attacker most wants.

What remains is a person, with incomplete information, deciding whether to run something. That has always been the scarce resource. The industry has spent two decades making everything around that decision faster.

The Gate Nobody Will Build