Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 100k Infected Repos Found on GitHub

apiiro.com

Post reply on HN
Print view View original

111–120 of 187 posts

Re: Over 100k Infected Repos Found on GitHub

#111

Post by Shared404 »

flyinghamster wrote: post #95
Ringz wrote: post #3

Earlier quoted context omitted.

> If you are a dev today, you should probably have at least thee firmly separated environments for work, hobby and personal stuff. The complexity of digital life takes on dimensions that make me doubt whether it can continue in the long term.

Indeed. My parents (age 80+, father was an engineer and gadget freak) flatly refuse to use smartphones. My dad has a bit of trouble with the new big-screen TV but can figure things out. My mom just can't cope with the new remote and user interface. My dad's enough on the ball that he doesn't fall for scams, but I despair for people who aren't prepared for this (or who don't realize that email is untrustworthy). All t…

> Are schools actually using things like the Pi and Arduino, or are we leaving it to parents to get such things into their hands?

Gen Z here checking in to say almost entirely the latter :/ .

Some schools have an elective that would get things into the hands of kids, but nowhere near 100% and they generally have a pretty low coverage of students at the school.

Re: Over 100k Infected Repos Found on GitHub

#112

Post by jprete »

simonw wrote: post #82
dspillett wrote: post #65

As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question: If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we'll see copilot & friends occasionally emit malwa…

It's a risk. Similar to the risk that if you accept PRs from coworkers without reviewing them they might have copied and pasted in some vulnerable code from somewhere. Using LLMs means investing more effort in code review. I think that's a worthwhile trade.

This is not a worthwhile trade. The person sending the PR should not send LLM code that they can't vouch for, under the expectation that reviewers will find any vulnerabilities. That's just dumping the work onto the reviewers.

Re: Over 100k Infected Repos Found on GitHub

#114

Post by instagib »

dspillett wrote: post #65

As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question: If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we'll see copilot & friends occasionally emit malwa…

I just posted about an llm issue referring to hijacking the huggingface conversion bot for safetensors.

https://news.ycombinator.com/item?id=39549482

“we show how an attacker could compromise the Hugging Face Safetensors conversion space and its associated service bot. These comprise a popular service on the site dedicated to converting insecure machine learning models within their ecosystem into safer versions.”

Re: Over 100k Infected Repos Found on GitHub

#115

Post by mgii »

hollerith wrote: post #56
silvestrov wrote: post #54

Github is failing the same way usenet failed: everybody could post stuff to usenet just like everybody can create a github repository and there is nothing that sets an official repository apart from a spammers repository. When Amazon has "the everything store" as main strategic goal, they get hit by "90% of everything is junk". So they end up being a store of mostly junk. Github should figure out if their product is…

Although finding over 100k infected repos is not good, it does not mean github is failing because the kind of programmer who would include an infected repo can find many other ways to create an insecure product if there weren't infected repos on github.

To be fair, the kind of programmer who would include an infected repo is almost everyone. Many infected repos have no indicators except for username to help you notice without a careful examination, especially in niche repos. When you have to move fast, it's natural to make such mistakes.

Re: Over 100k Infected Repos Found on GitHub

#116

Post by richbell »

mgii wrote: post #42
dgellow wrote: post #17

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and…

There seems to be a lot of confusion between malware and vulnerabilities. None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities. Good as they'll be in detecting vulnerabilities, you are still unprotected from malicious code planted in your code bases.

> None of the vendors mentioned in this subthread detects malicious code, only vulnerabilities

Sonatype does if you pay $$$ for Firewall, but that only catches things installed via a package manager.

Re: Over 100k Infected Repos Found on GitHub

#117

Post by davidmurdoch »

dgellow wrote: post #17

What tooling are you people using to avoid that type of issues at your workplace? And are you satisfied with your setup? We are a pretty small team developing SDKs that have a pretty large amount of weekly download. I’ve been evaluating tools such as snyk, aikido.dev, and some solutions built on top of renovate (that we already use for general dependency management), it’s not obvious if they would help with this, and…

LavaMoat and @lavamoat/allowscripts (which does the opposite of it's name).

Re: Over 100k Infected Repos Found on GitHub

#118

Post by mgii »

arp242 wrote: post #90
UrineSqueegee wrote: post #61

Earlier quoted context omitted.

I don't think you truly grasp how small this number is, this is actually good, like really really good. Github has about half a billion repositories.

Not only that, millions of these type of repos get created, and the vast majority are caught and deleted. The article mentions this: "Most of the forked repos are quickly removed by GitHub, which identifies the automation. However, the automation detection seems to miss many repos, and the ones that were uploaded manually survive. Because the whole attack chain seems to be mostly automated on a large scale, the 1% th…

Notice that as it seems, the vast majority are caught and deleted due to the intense automation, not the detection of malicious contents. If the actor was to run a smoother automation process, probably nothing would have been deleted. (disclaimer: author this article)

Re: Over 100k Infected Repos Found on GitHub

#119

Post by DrScientist »

bunderbunder wrote: post #97
keepamovin wrote: post #71

This sucks. Supply chain is such an issue. Even tho we don't currently target any npm releases, I make use of socket.dev to monitor my project by creating an npm release for it. But my project BrowserBox (lightweight virtualized web browser) only uses ~800 dependencies including all descendents, with only 19 top-level deps (cool your heels non-JavaScript folks, this is comparatively lightweight for a full stack boing…

"only uses ~800 dependencies" slightly horrifies me. I was horrified to see how much time I started spending fussing with dependency hell after I moved from .NET to Java about 10 years back. And I am currently horrified by how much time I have to spend doing vulnerability updates and fussing with dependency hell in both Java and Python projects nowadays. I think maybe the reason I didn't have this problem to nearly t…

Totally agree - I think package managers that make it very easy to pull in huge transitive dependency trees are fundamentally making the wrong thing too easy.

First all those dependences you pull in aren't necessarily dependencies because they are done at the package level. If I use one class/function from package A, I may not need any of the package A sub-dependencies - yet these package managers will pull them in recursively down the tree.

Second you are trading control for having somebody else manage version dependencies - not sure that saves you time in the end - especially if you took an approach that didn't pull in unncessary dependencies in the first place.

Re: Over 100k Infected Repos Found on GitHub

#120

Post by dboreham »

bunderbunder wrote: post #97
keepamovin wrote: post #71

This sucks. Supply chain is such an issue. Even tho we don't currently target any npm releases, I make use of socket.dev to monitor my project by creating an npm release for it. But my project BrowserBox (lightweight virtualized web browser) only uses ~800 dependencies including all descendents, with only 19 top-level deps (cool your heels non-JavaScript folks, this is comparatively lightweight for a full stack boing…

"only uses ~800 dependencies" slightly horrifies me. I was horrified to see how much time I started spending fussing with dependency hell after I moved from .NET to Java about 10 years back. And I am currently horrified by how much time I have to spend doing vulnerability updates and fussing with dependency hell in both Java and Python projects nowadays. I think maybe the reason I didn't have this problem to nearly t…

> I moved from .NET to Java

Oh boy. That's just the first gate of hell. You should try JS!

Post reply on HN