@Agasaro-Sandra @IshimweJoliePrincesse @KOlivier2119 @Kayinamura-Karimba-Geofrey @LuckyBelieve @Mugisha-Samuella @Ndahiroloicke @NyLaurent @PaccyC @SibomanaEdouard @Umulysa @ashrafutuyubahe @bella-blandine @davinyiringabo @ihirwepatrick @jodosjodos @louange-lidvine @mahingaRodin @mugisha189 @u-leslie
⚠️ ACTION REQUIRED — Re-clone after security cleanup (git history rewritten)
We completed a security cleanup of both GMS repos (frontend-v2 and backend-api-v2) after finding malicious files — a git-history–spoofing script (config.bat) and a hidden VS Code auto-run loader — that had spread across every branch. The repos are now clean, and an automated Security IOC Scan now blocks these files from being reintroduced.
What this means for you
We rewrote git history to remove the malware from all past commits, so every commit ID has changed. Your existing local clones hold the old, infected history. If you push from an old clone, you will reintroduce the malware and undo the cleanup.
What you must do — before your next push (both repos)
Simplest & safest — delete your local copy and clone fresh:
git clone https://github.com/GMS-codebase/frontend-v2.git
git clone https://github.com/GMS-codebase/backend-api-v2.git
Or, if you have local work to keep — per branch:
git fetch origin
git reset --hard origin/<your-branch>
git gc --prune=now
Important
- Commit/back up anything you care about first —
reset --hard discards uncommitted changes.
- Do NOT force-push from an old clone.
- In VS Code, do not enable automatic/auto-run tasks if prompted.
- A new Security IOC Scan runs on every push/PR — don't bypass it. If it fails, comment here.
Reply on this issue if you hit any trouble re-syncing.
— @cielo-b
@Agasaro-Sandra @IshimweJoliePrincesse @KOlivier2119 @Kayinamura-Karimba-Geofrey @LuckyBelieve @Mugisha-Samuella @Ndahiroloicke @NyLaurent @PaccyC @SibomanaEdouard @Umulysa @ashrafutuyubahe @bella-blandine @davinyiringabo @ihirwepatrick @jodosjodos @louange-lidvine @mahingaRodin @mugisha189 @u-leslie
We completed a security cleanup of both GMS repos (
frontend-v2andbackend-api-v2) after finding malicious files — a git-history–spoofing script (config.bat) and a hidden VS Code auto-run loader — that had spread across every branch. The repos are now clean, and an automated Security IOC Scan now blocks these files from being reintroduced.What this means for you
We rewrote git history to remove the malware from all past commits, so every commit ID has changed. Your existing local clones hold the old, infected history. If you push from an old clone, you will reintroduce the malware and undo the cleanup.
What you must do — before your next push (both repos)
Simplest & safest — delete your local copy and clone fresh:
Or, if you have local work to keep — per branch:
Important
reset --harddiscards uncommitted changes.Reply on this issue if you hit any trouble re-syncing.
— @cielo-b