A trojanized fork is a modified copy of a legitimate project that preserves the expected features while hiding additional malicious code. It looks and behaves like the original for normal users, but one or more code paths contain unauthorized logic such as data theft, backdoors, or workflow manipulation.
In cyber security, this matters because familiar behavior can defeat casual review. Build tests may pass, dependency checks may look clean, and developers may assume the package is trustworthy because it resembles a well-known library. Attackers use trojanized forks in supply-chain attacks, typosquatting, and tampered open-source packages, often targeting a specific function, environment, or business process. Defenders reduce the risk by verifying package identity, enforcing signed releases, pinning versions, reviewing diffs from upstream, and monitoring sensitive workflows for integrity issues rather than only malware signatures.