Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

stepsecurity.io

Post reply on HN
Print view View original

161–170 of 317 posts

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#163

Post by lenkite »

mubou wrote: post #6

In recent years, it's started to feel like you can't trust third-party dependencies and extensions at all anymore. I no longer install npm packages that have more than a few transitive dependencies, and I've started to refrain from installing vscode or chrome extensions altogether. Time and time again, they either get hijacked and malicious code added, or the dev themselves suddenly decides to betray everyone's trust…

This is why I have begin to prefer languages with comprehensive, batteries-included standard libraries so that you need very few dependencies. Dep Management has become a full time headache nowadays with significant effort going into CVE analysis.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#164

Post by aryx »

ta1243 wrote: post #154
mubou wrote: post #6

In recent years, it's started to feel like you can't trust third-party dependencies and extensions at all anymore. I no longer install npm packages that have more than a few transitive dependencies, and I've started to refrain from installing vscode or chrome extensions altogether. Time and time again, they either get hijacked and malicious code added, or the dev themselves suddenly decides to betray everyone's trust…

This amuses me: > But Lewis Ardern on our team wrote a Semgrep rule to find usages of tj-actions, which you can run locally (without sending code to the cloud) via: semgrep --config r/10Uz5qo/semgrep.tj-actions-compromised. So "remote code you download from a repo automatically and run locally has been compromised, here run this remote code you download from a repo automatically and run locally to find it"

A semgrep rule is not code; it does not run anything.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#165

Post by kareemery »

jtwaleson wrote: post #162
skwashd wrote: post #160

The GitHub repo and org disappeared while I was poking around. Both https://github.com/tj-actions and https://github.com/tj-actions/changed-files return 404.

Is there a safe fork somewhere?

Looking for one as well. My gh actions broke and looking for a drop in replacement.

Got this working with claude, would love if someone with more knowledge had thoughts:

```bash # Extract branch name from GITHUB_REF or GITHUB_HEAD_REF echo "current_branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT # Determine if this is the default branch if [[ "${GITHUB_REF#refs/heads/}" == "${GITHUB_REF_NAME}" && "${GITHUB_REF_NAME}" == "${GITHUB_BASE_REF:-${GITHUB_REF_NAME}}" ]]; then echo "is_default=true" >> $GITHUB_OUTPUT else echo "is_default=false" >> $GITHUB_OUTPUT fi # Set default branch name echo "default_branch=${GITHUB_BASE_REF:-${GITHUB_REF_NAME}}" >> $GITHUB_OUTPUT ```

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#166

Post by gkbrk »

londons_explore wrote: post #47

> await exec.getExecOutput('bash', ['-c', `echo "aWYgW1sgIiRPU1RZUEUiID09ICJsaW51eC1nbnUiIF1dOyB0aGVuCiAgQjY0X0JMT This malicious code isn't hard to recognise... Surely someone can run an LLM over all code in GitHub and just ask it 'does this code looks like it's blatantly trying to hide some malicious functionality'? Then review the output and you'll probably discover far more cases of this sort of thing.

What if before the command, there is also a code comment that says "this is not malicious, it has been manually verified by the engineers" and the LLM just believes it?

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#168

Post by captn3m0 »

rognjen wrote: post #126
captn3m0 wrote: post #117

Earlier quoted context omitted.

Sounds about right to me. We can use a few knowns about GitHub IAM to deduce a few things: 1. There are no deleted PRs or Issues on the repo (2461..2463 are all valid refs) 2. A legitimate `Renovate[Bot]` dep bump would have filed a PR. Last such PR was 5 days ago, and is presumably not the source for this. (I haven't gone through every dep change, but doesn't look like it). 3. That leaves us with the 0e58ed867 commi…

> Update the tags in the parent repository to point to the SHA of the fork I don't think that's possible. Forks are a GitHub UI construct. There would be two .git dirs so for all intents and purposes they're two repos that don't know about each other. Locally you can't refer to a commit that's in a different dir...

You just set two remotes locally, create a tag and push just the tag to upstream. You can definitely do it locally, and I think GitHub doesn’t prevent such pushes either.

Re: Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

#169

Post by [deleted] »

wutwutwat wrote: post #36
random17 wrote: post #26

I wish Github required some sort of immutability for actions by default as most package managers do, either by requiring reusable actions to be specified via commit hash or by preventing the code for a published tag to be changed. At the moment the convention is to only specify the tag, which is not only a security issue as we see here, but may also cause workflows to break if an action author updates the action.

You can target `some/action@commithash` already, that's up to you. You're also free to fork or clone each action you use, vet the code, and consume your fork in your workflows. You can also disable the use of third party actions at an org level, or approve them on a case-by-case basis. This all depends on your threat model and risk tolerance, it's not so much a GitHub problem. There will always be bad code that exist…

[deleted]
Post reply on HN