Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 100k Infected Repos Found on GitHub

apiiro.com

Post reply on HN
Print view View original

31–40 of 187 posts

Re: Over 100k Infected Repos Found on GitHub

#31

Post by kangabru »

I've been gradually improving my dev setup security over the past few months based on continuous reports like this. Here are things I'm trying out to improve my setup: - Use VSCode dev containers for development [1a]. Once you've created one once then they're quite easy to use and you don't need much Docker knowledge - it just needs to be installed. It's perfect for spinning up web/console apps but I had trouble with other stuff like Flutter and Electron. - Similarly I got familiar with GitHub Codespaces for smaller projects [1b]. I've done live coding in an interview before (where I had to modify a simple Node project) and I would absolutely use containers/codespaces for anything like that these days [2]. You can spin one up straight from any GitHub repo page and they're easy to work with. - Read the OWASP guidelines regularly for things like npm, Node, and Docker best practises. e.g. for Docker use the smallest image you can (Alpine) and use explicit Docker image tags [3]. - Review npm/python packages before installing them using socket.dev - it shows a full dependency security overview for things like env variable access, network calls, supply chain attacks, recent code ownership changes etc. You can also disable postinstall scripts globally as suggested by OWASP [4].

[1a] https://code.visualstudio.com/docs/devcontainers/create-dev-... [1b] https://github.com/codespaces [2] https://www.welivesecurity.com/en/eset-research/lazarus-luri... [3] https://cheatsheetseries.owasp.org/cheatsheets/NodeJS_Docker... [4] https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_...

Re: Over 100k Infected Repos Found on GitHub

#32

Post by tsbinz »

simonjgreen wrote: post #23
sigmoid10 wrote: post #2

I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.

> If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff. I hate to call it out, but, isn’t that table stakes? Blending work and personal environments should be an obvious no. Are employers out there ok with this?

Big employers (at least the ones I know) aren't regarding work, I guess with smaller ones it maybe is, especially with BYOD?

I think the issue probably isn't uncommon for freelancers/contractors too.

Hobby and personal stuff I think a lot of people mix, I don't use the machine where I do bank/tax/etc stuff for hobby work, but I'm not sure that's common.

Re: Over 100k Infected Repos Found on GitHub

#33

Post by andreashaerter »

toppy wrote: post #13
Animats wrote: post #10

So who's behind this? Who's doing something about it? Where's Homeland Security on this? This is their job. This is an attack. "The ease of automatic generation of accounts and repos on GitHub and alike, using comfortable APIs and soft rate limits that are easy to bypass, combined with the huge number of repos to hide among, make it a perfect target for covertly infecting the software supply chain. This campaign, alo…

Where's GitHub Fraud Detection Team?

busy blocking the co-founder https://twitter.com/defunkt/status/1754610843361362360

Re: Over 100k Infected Repos Found on GitHub

#34

Post by richbell »

alentred wrote: post #27
dgellow wrote: post #17

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and…

You may look into Trivy [0] , works very well for me so far. [0] https://trivy.dev/

As far as I know, Trivy only flags known vulnerabilities and would not protect against supply-chain attacks like this.

Re: Over 100k Infected Repos Found on GitHub

#35

Post by AdieuToLogic »

Animats wrote: post #10

So who's behind this? Who's doing something about it? Where's Homeland Security on this? This is their job. This is an attack. "The ease of automatic generation of accounts and repos on GitHub and alike, using comfortable APIs and soft rate limits that are easy to bypass, combined with the huge number of repos to hide among, make it a perfect target for covertly infecting the software supply chain. This campaign, alo…

> So who's behind this? Who's doing something about it?

CISA[0] might be a good agency to begin with, if for no other reason than to find a more appropriate one to contact.

0 - https://www.cisa.gov/about

Re: Over 100k Infected Repos Found on GitHub

#36

Post by overstay8930 »

Ringz wrote: post #3
sigmoid10 wrote: post #2

I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.

> If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff. The complexity of digital life takes on dimensions that make me doubt whether it can continue in the long term.

Does nobody use VMs anymore? I just spin up EC2 instances with Shortcuts on my Mac and destroy them when I’m done. Run a bash script to save my work to s3.

Are people just doing everything locally or something?

Re: Over 100k Infected Repos Found on GitHub

#37

Post by [deleted] »

dgellow wrote: post #17

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and…

[deleted]

Re: Over 100k Infected Repos Found on GitHub

#38

Post by AlienRobot »

jbverschoor wrote: post #9
sigmoid10 wrote: post #2

I've noticed these too by randomly stumbling over similar repos. I usually don't run code from random repos, but now I have reached a point where I spin up a sandbox vm even when I trust the repo and the owners. If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff.

Check out container-shell [1] it is one of the use cases. Not a VM but a docker container. Chroot a directory in a container, and does some automatic house keeping etc [1] https://github.com/jrz/container-shell

A link to a github repo? How do I know it's not infected?

Re: Over 100k Infected Repos Found on GitHub

#39

Post by rwmj »

zavaz wrote: post #16

A simple case of marking these officially would get some attention.

And later, Github could start selling these blue ticks. What could possibly go wrong? /s

(I do agree with your point that Github should be better at displaying which repo is the official one for a project.)

Post reply on HN