A malicious commit is a code change made to introduce harmful, hidden, or deceptive behavior into a repository. It may add backdoors, weaken validation, redirect downloads, steal secrets, or disguise risky logic as a routine maintenance update. Because commits are often trusted as part of normal development, they can be an effective way to smuggle abuse into software.
In cyber security, malicious commits matter because they target the software supply chain: if an attacker gains repository access, compromises a maintainer account, or exploits an orphaned project, a single commit can affect many users downstream. Defenses include code review, signed commits, branch protections, least-privilege access, and monitoring for unusual changes in ownership or history. In package ecosystems, a suspicious commit may be the first sign that a legitimate maintenance workflow has been turned into an attack path.