Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found 10k GitHub repositories distributing Trojan malware

orchidfiles.com

Post reply on HN
Print view View original

191–200 of 268 posts

Re: I found 10k GitHub repositories distributing Trojan malware

#191

Post by tommica »

vintermann wrote: post #183
guhcampos wrote: post #81

> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…

Political manipulation is a problem, but I don't think it's nearly as profitable as pushing scams and gambling.

On that level, power and control trumps profit

Re: I found 10k GitHub repositories distributing Trojan malware

#192

Post by makethembroke »

vintermann wrote: post #183
guhcampos wrote: post #81

> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…

Political manipulation is a problem, but I don't think it's nearly as profitable as pushing scams and gambling.

a kind of

Re: I found 10k GitHub repositories distributing Trojan malware

#193

Post by codedokode »

mittensc wrote: post #186
codedokode wrote: post #184

This highlights the problem with legacy desktop OSes like Windows, Linux and MacOS: they allow a random program from Internet to get full access to the computer. Windows and Mac display a warning that the program might be malicious, but how is the user supposed to check it? Do Windows and MacOS developers expect every user to disassemble the program? That's just shifting responsibility instead of solving the root iss…

You can use VMs for sandboxes. Linux main feature is that you are free to do anything you want. Linux does verify signatures for packages from official repos. Linux has features like SELinux and AppArmor. If you want to install a random package, you are free to do and its your responsibility. Equivalent is side loading in android. On iOS Apple doesn't even let you have full Firefox... That is wrong. And yet, there ha…

I thought about VM but it would be pretty expensive and require lot of RAM (which is not cheap nowadays and not always upgradeable on laptops. How would you upgrade your 8 Gb MacBook?) and CPU overhead to emulate the hardware and run one more kernel. The program in VM would not be able to use OpenGL/Vulkan, access the audio card with low latency (for working with audio), connect to DBus (to interact with other software).

I actually ran Windows games like Cyberpunk in qemu on a Linux host without performance loss, but that required adding a dedicated GPU for guest and to use realtime audio, one needs to pass through an audio card into the guest.

Furthermore, the CPU already provides a "sandbox" (isolated memory) for processes. The problem is that Linux allows the program to ask the kernel to do anything.

> Linux has features like SELinux and AppArmor.

Neither SELinux not AppArmor allows to show a question "would you like to allow program N to access your microphone" or "would you like to let the program connect to github.com? (Yes) (No) (With decrypting SSL traffic)". They look like they are made to comply with some outdated standards from 80s.

The best you can do today is either write your own sandbox around Linux namespaces (very complicated), or try lightweight VMs like Firecracker, or paravirtualization (like VM but with a shared kernel). Those solutions are made for server use, not for desktop, and require lot of work and programming.

> If you want to install a random package, you are free to do and its your responsibility. Equivalent is side loading in android.

I want to install random packages and still be safe. That's the point of installing an OS, to be able to run random programs on the computer.

Re: I found 10k GitHub repositories distributing Trojan malware

#194

Post by saidnooneever »

guhcampos wrote: post #81

> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…

2 is full on speculation. It can be any kind of purpose.

Re: I found 10k GitHub repositories distributing Trojan malware

#195

Post by codedokode »

realusername wrote: post #187
codedokode wrote: post #184

This highlights the problem with legacy desktop OSes like Windows, Linux and MacOS: they allow a random program from Internet to get full access to the computer. Windows and Mac display a warning that the program might be malicious, but how is the user supposed to check it? Do Windows and MacOS developers expect every user to disassemble the program? That's just shifting responsibility instead of solving the root iss…

> as long as you don't grant dangerous permissions and your kernel is not outdated There's like 2 or maybe 3 phone models in the world without an outdated kernel in Android. And then sure, Android and iOS sandboxing is better but in the same time, the quality of the apps and the vetting is 100x worse than your average Linux distribution so I'm not sure that makes up the difference.

In Linux there is no vetting. Does anyone verify proprietary AI agents like Claude Code? Software like VS Code? Games? They are distributed through random sites and cannot even be banned.

You could restrict yourself to the official repositories, but there is a limited selection of software. There are no closed-source software, like audio editing plugins, graphic editors, games, AI agents and so on. Even open-source software is often missing in official repositories.

Re: I found 10k GitHub repositories distributing Trojan malware

#196

Post by saidnooneever »

vintermann wrote: post #183
guhcampos wrote: post #81

> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…

Political manipulation is a problem, but I don't think it's nearly as profitable as pushing scams and gambling.

just get residential botnets to watch ur youtube channel click all the adds u dont need many bots..There are many ways to monetize things.

Governments just run sim farms etc. they dont need to use this kind of approach for political influece. Not to say that some dont but generally they will not be stealing accounts. (most bots involved in campaigns to get trump in his seat were not stolen accounts)

Re: I found 10k GitHub repositories distributing Trojan malware

#197

Post by mowfask »

Adding a link to a malware zip? That seems pretty naive.

Where are all the training-data poisoning repositories? Those set up so the next generation LLMs will be trained to include malware in the code they generate. Isn't that the new kind of supply-chain attack that's probably happening right now?

Re: I found 10k GitHub repositories distributing Trojan malware

#198

Post by realusername »

codedokode wrote: post #195
realusername wrote: post #187

Earlier quoted context omitted.

> as long as you don't grant dangerous permissions and your kernel is not outdated There's like 2 or maybe 3 phone models in the world without an outdated kernel in Android. And then sure, Android and iOS sandboxing is better but in the same time, the quality of the apps and the vetting is 100x worse than your average Linux distribution so I'm not sure that makes up the difference.

In Linux there is no vetting. Does anyone verify proprietary AI agents like Claude Code? Software like VS Code? Games? They are distributed through random sites and cannot even be banned. You could restrict yourself to the official repositories, but there is a limited selection of software. There are no closed-source software, like audio editing plugins, graphic editors, games, AI agents and so on. Even open-source s…

There's vetting, apps like Facebook or Candy Crush would never past the most basic repository scrutiny if you made it Linux native and would never be included anywhere, even if they were made open source.

You can constrast that with the Play Store where just searching for ChatGPT brings you a fake app on top (and before you bring the appstore, it was the same there until they banned the keyword after some bad press)

And yeah it's up to you if you install something outside of repositories, it's your computer.

Re: I found 10k GitHub repositories distributing Trojan malware

#199

Post by ma2kx »

Is this also a some kind of a Trojan/malware attack?

https://news.ycombinator.com/item?id=48594733

https://pypi.org/project/prylint/

> A Rust reimplementation of pylint that produces byte-for-byte identical output — 15–2300× faster (median ~85×).

> prylint is not "inspired by" pylint. [...] Where pylint has bugs, prylint reproduces them. Where pylint crashes, prylint reports the same crash message.

Re: I found 10k GitHub repositories distributing Trojan malware

#200

Post by mittensc »

codedokode wrote: post #193
mittensc wrote: post #186

Earlier quoted context omitted.

You can use VMs for sandboxes. Linux main feature is that you are free to do anything you want. Linux does verify signatures for packages from official repos. Linux has features like SELinux and AppArmor. If you want to install a random package, you are free to do and its your responsibility. Equivalent is side loading in android. On iOS Apple doesn't even let you have full Firefox... That is wrong. And yet, there ha…

I thought about VM but it would be pretty expensive and require lot of RAM (which is not cheap nowadays and not always upgradeable on laptops. How would you upgrade your 8 Gb MacBook?) and CPU overhead to emulate the hardware and run one more kernel. The program in VM would not be able to use OpenGL/Vulkan, access the audio card with low latency (for working with audio), connect to DBus (to interact with other softwa…

> Neither SELinux not AppArmor allows to show a question "would you like to allow program N to access your microphone"

Permissions on microphone device would work, build your own UI / virtual device or generate one with claude if you really want popups.

> "would you like to let the program connect to github.com? (Yes) (No) (With decrypting SSL traffic)"."

I actually have something for this. Firewall everything blocked, domains unblocked via DNS request if I allow them.

Linux is very powerful here compared to iOS - can you block specific domains there?

> The best you can do today is either write your own sandbox around Linux namespaces (very complicated), or try lightweight VMs like Firecracker, or paravirtualization (like VM but with a shared kernel).

What do you think the sandbox on ios/android is?, still a vm/namespace/container...

> require lot of work and programming.

Sure, but you learn.

> I want to install random packages and still be safe. That's the point of installing an OS, to be able to run random programs on the computer.

That's not true anywhere. I would not feel safe with random apks or random store entries on android OR iOS. On iOS i lived through the whole 'access a webpage to get jailbreak' phase... with no way around it since mandatory safari

So, other OSs just give you the impression of safety. And you're locked. (iOS with safari...)

On Linux you are free, up to your capabilities.

Post reply on HN