Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 10k GitHub repositories distributing Trojan malware

orchidfiles.com

Post reply on HN
Print view View original

141–150 of 268 posts

Re: I found 10k GitHub repositories distributing Trojan malware

#141

Post by shermantanktop »

tuetuopay wrote: post #111
weird-eye-issue wrote: post #19

Earlier quoted context omitted.

This is where password managers are useful because they would refuse to fill in login information since the domain doesn't match

That's without considering a lot of banks have non-textual inputs for their passwords. Man they love their scrambled virtual keyboard! I think the worst I ever had was HSBC that asked me for fragments of my password, like characters 4, 6, 7, 11, and 12. Absolute bonkers of a security theatre.

Had a similar UK bank experience. Without knowing it would be used for that, I had created a password that had digits. So "What's the 4th character" would be something like "6," "What's the 6th digit" would be "2," like an Abbott and Costello routine.

Re: I found 10k GitHub repositories distributing Trojan malware

#145

Post by ForOldHack »

This is what it is used for:

https://dev.to/andersoncontreira/warning-to-developers-a-new...

A “recruiter” (sometimes pretending to be a CEO/HR) contacts you. The job looks amazing — above-market salary, remote position, paid in USD, etc. They ask for your CV and GitHub. They say you’re “approved for the next stage” without any real interview. Before the call, they send you a codebase to review or modify as a “technical test.”

When I get one of these, I automatically spin up a cloned VM, and test it there, which for the most part it gets infected immediately. as I watch the VM connect to odd places ( C&C computers ) for which I add any names/IP addresses to my host file, and then spin up another cloned VM, with the adjustments to the hosts file, and watch the malware get all lonely... but once, it was able to escape the VM... so I had to scramble to disinfect both the RM and the VM, and then update, and look around for hardening tools.

Its satisfying to delete an infected VM, with a "Not this time Jack."

Re: I found 10k GitHub repositories distributing Trojan malware

#146

Post by ForOldHack »

xantronix wrote: post #92
bananamogul wrote: post #77

I reported a repo containing obvious nulled software to GitHub in February 2024. The title is "nulled WHMCS" and it's a full copy of that software with copy protection removed. It couldn't be more cut and dried. The repo is still there 2+ years later and GitHub has taken no action. If GitHub can't respond to tickets pointing out obvious pirated software, I don't think they care about anything anyone puts up.

GitHub is so close to becoming SourceForge. In order to become the scum-infested cesspool it truly longs to be, Microsoft needs to relentlessly serve ads on GitHub. Then, the cycle will once again be complete. I can't wait to discover the next thing to be disappointed by in a decade's time.

Nice quote of Darth Vader there ;) "The cycle will once again be complete."

Also reminds me to update my fake CV.

Re: I found 10k GitHub repositories distributing Trojan malware

#147

Post by toofy »

emodendroket wrote: post #8

I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.

this issue was found specifically because these things are open source.

the ethos of open source is that bugs and malicious code are more likely to be spotted.

we’re discussing this on hn right now strictly because the code is open, the abusive code was found because it is open.

abusive people will make abusive software. the problem lies in the fact that despite absolutely having the resources, microsoft won’t do anything about it, not in the fact that we can see the abuse.

the problem is microsoft, yet again.

Re: I found 10k GitHub repositories distributing Trojan malware

#148

Post by ForOldHack »

embedding-shape wrote: post #9
emodendroket wrote: post #8

I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.

> the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons You've been living on such a principle? That sounds insane, why would something not be nefarious just because you can read the code? The way I was "raised" by FOSS greybeards screaming at me through web forums, was that any software available on 3rd party websites anyone can upload…

It does not just sound insane, it is insane...

"He reverse-engineered an actual attack. The project contained scripts that enabled code injection and crypto-wallet theft. His post (highly recommended):"

https://www.linkedin.com/pulse/como-identifiquei-um-golpe-em...

"The execp package (version 0.0.1) is an infamous, malicious dependency frequently used in recent supply-chain attacks and job interview scams. Threat actors embed this 9-year-old package into seemingly innocent "technical assessments" or projects. When you run npm install, it quietly executes arbitrary shell commands in the background to compromise your machine."

Re: I found 10k GitHub repositories distributing Trojan malware

#149

Post by Gigachad »

criddell wrote: post #127
tedd4u wrote: post #80

Earlier quoted context omitted.

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

On Linux, would something like Snap or Flatpak have protected them? It seems nuts that a random executable should have access to the password service.

Yes if the flatpak sandboxing is enabled. A flatpak can just request access to anything, the software store thing shows a bunch of scary warnings when they do this but many users probably ignore them.

Re: I found 10k GitHub repositories distributing Trojan malware

#150

Post by schrodinger »

Jimmc414 wrote: post #106

This is happening to me as well. I have a few moderately popular open source projects and I have found my name attached to new projects that I have nothing to do with or they are derivatives of my projects with redirection to unknown sites. Legitimate projects: https://github.com/jimmc414/onefilellm https://github.com/jimmc414/Kosmos https://github.com/jimmc414/cctrace Projects using my name which I have no affiliati…

Idk if this is intentional or just part of an innocent site that’s unwittingly hosting these but I just got a “we’re verifying your browser” page, as if _I’m_ the suspicious one. Nice social engineering.
Post reply on HN