https://gist.github.com/gmatuz/7186f583df5f28196cc1f402af3bf...
This gist is pretty much the exact code, from the base64 encoded stuff. Looks like who ever put this in at least neafed the shell script.
Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
121–130 of 317 posts
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#122Am I seeing this correctly, that a (fake/impersonation?) Renovate bot actually proposed the fix... and then other repositories trickled that fix in, also suggested by Renovate or Dependabot, as the dependency updated?
I usually fork (or create my own) actions, as I do not trust the whole chain on GitHub. The marketplace does no enforcement. It is really based on trust you have in the 3rd-party... and I do not have this; as many actions have side-effects, or only operate on a specific runner OS, etc.
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#123Earlier quoted context omitted.
Yes. Same with browser plugins. I've heard multiple free-plugin authors say they're receiving regular offers to purchase their projects. I'm sure some must take up the offer.
For an example of a scary list of such offers, see https://github.com/extesy/hoverzoom/discussions/670
do you know of any other ones like this that post their offers?
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#124How does this siphon the secrets away? It looks like it just dumps them out to stdout and stops there.
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#125In recent years, it's started to feel like you can't trust third-party dependencies and extensions at all anymore. I no longer install npm packages that have more than a few transitive dependencies, and I've started to refrain from installing vscode or chrome extensions altogether. Time and time again, they either get hijacked and malicious code added, or the dev themselves suddenly decides to betray everyone's trust…
This is the death of fun. Like when you had to use SSL for buying things online. Adding SSL was not bad, don't get me wrong. It's good that it's the default now. However. At one point it was sorta risky, and then it became required. Like when your city becomes crime ridden enough that you have to lock your car when you go into the grocery store. Yeah you probably should have been locking it the whole time. what would…
Just you wait. Here in America when your city becomes crime ridden enough you start leaving it unlocked again.
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#126Earlier quoted context omitted.
Presumably the cracker: 1. spoofed an account whose PRs were auto-merged (renovate[bot]) 2. found that `index.js` was marked as binary, and knew that GitHub is "helpful" (for the exploit), and hides diffs in the PR for that file by default 3. shoved the chunk of base64 wayyyy down the commit, so the maintainer had review fatigue by the time they scrolled. Having "memdump.py" in the commit in plaintext would certainly…
Sounds about right to me. We can use a few knowns about GitHub IAM to deduce a few things: 1. There are no deleted PRs or Issues on the repo (2461..2463 are all valid refs) 2. A legitimate `Renovate[Bot]` dep bump would have filed a PR. Last such PR was 5 days ago, and is presumably not the source for this. (I haven't gone through every dep change, but doesn't look like it). 3. That leaves us with the 0e58ed867 commi…
> Update the tags in the parent repository to point to the SHA of the fork
I don't think that's possible.
Forks are a GitHub UI construct.
There would be two .git dirs so for all intents and purposes they're two repos that don't know about each other.
Locally you can't refer to a commit that's in a different dir...
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#127Earlier quoted context omitted.
> In this specific case, the bad actor changes all of the version tags to point to their malicious commit: https://github.com/tj-actions/changed-files/tags This required compromising the entire repository, yes? It can't be explained as the maintainer being tricked into merging something malicious?
The repo looks like it uses itself in its workflows, so it's possible that the commit being merged resulted in the necessary credentials being leaked to the attacker.
There doesn't seem to be a PR for the commit though.
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#128I'm sorry I must be missing something.
The examples from the repo itself aren't helping to explain.
Why would anyone use this whole convoluted nodejs thing when `git diff-tree` exists?
I'm struggling to see a scenario where this isn't just part of some deliberately over complicated rube Goldberg setup.
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#129Earlier quoted context omitted.
Yes. Same with browser plugins. I've heard multiple free-plugin authors say they're receiving regular offers to purchase their projects. I'm sure some must take up the offer.
For an example of a scary list of such offers, see https://github.com/extesy/hoverzoom/discussions/670
This is why I fork the extensions I use, with the exception of uBlock. Basically just copy the extension folder, if I can't find it on GitHub. That way I can audit the code and not have to worry about an auto-update sneaking in something nefarious. I've had two extensions in the past suddenly start asking for permissions they definitely did not need, and I suspect this is why.
Btw, here's a site where you can inspect an extension's source code before you install it: https://robwu.nl/crxviewer/
Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos
#130Earlier quoted context omitted.
This is the death of fun. Like when you had to use SSL for buying things online. Adding SSL was not bad, don't get me wrong. It's good that it's the default now. However. At one point it was sorta risky, and then it became required. Like when your city becomes crime ridden enough that you have to lock your car when you go into the grocery store. Yeah you probably should have been locking it the whole time. what would…
Just you wait. Here in America when your city becomes crime ridden enough you start leaving it unlocked again.
Used to live near San Francisco, and had a lot of coworkers say they intentionally leave their windows down when parking in SF so that burglars don't break the glass to steal something!