Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows

blog.pypi.org

Post reply on HN
Print view View original

11–20 of 21 posts

Re: PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows

#11

Post by NeutralForest »

blibble wrote: post #10
zahlman wrote: post #3

> Attackers targeted a wide variety of repositories, many of which had PyPI tokens stored as GitHub secrets, modifying their workflows to send those tokens to external servers. While the attackers successfully exfiltrated some tokens, they do not appear to have used them on PyPI. It's wild to me that people entrust a third-party CI system with API secrets, and then also entrust that same system to run "actions" provi…

it's even worse that that the CI system itself encourages you to import random third party code into your CI workflow, based on mutable tags which then receives full privileges the entire thing is insane

That's why I stick mostly with Github actions and pin the SHA of the commits instead of the tag version.

Re: PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows

#12

Post by blibble »

NeutralForest wrote: post #11
blibble wrote: post #10

Earlier quoted context omitted.

it's even worse that that the CI system itself encourages you to import random third party code into your CI workflow, based on mutable tags which then receives full privileges the entire thing is insane

That's why I stick mostly with Github actions and pin the SHA of the commits instead of the tag version.

yes, it supports it, but it's not the default, is a pain and fills your build file with a load of noise

so very few use it

it's not made obvious that the tag isn't immutable

although you might be happy with the contents of what you've imported right now, who says it won't be malicious in a year's time

people inadvertently give full control of their build and all their secrets to whoever controls that repository (now, and in the future)

making it easy to do the right thing is an important part of API design and building secure systems, and these CI systems fail miserably there

Re: PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows

#13

Post by kinow »

nodesocket wrote: post #4

While Python being more widely used than JS, it's interesting the majority of attacks and breaches come from NPM. The consensus seems to be that Python offering a standard library greatly reduces the attack surface over JS. I tend to agree with this, a decently large Flask python app I am working on has 15 entries in requirements.txt (many of which being Flask plugins).

I also think the same. While in Java the stdlib lacks a few functions, long ago Apache Commons became the de-facto complement for the Java stdlib, being replaced/complemented by other libs over time, and eventually even becoming obsolete with newer versions of Java. But I always had the impression that having Apache Software Foundation components (with a good release/security process) helped Java to mitigate a lot of attacks.

Re: PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows

#14

Post by Liskni_si »

If you can change a GitHub Actions workflow to exfiltrate a token, what prevents you from changing the workflow that uses Trusted Publishing to make changes to the package before publishing it? Perhaps by adding an innocent looking use of an external Action?

Re: PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows

#15

Post by magnio »

nodesocket wrote: post #4

While Python being more widely used than JS, it's interesting the majority of attacks and breaches come from NPM. The consensus seems to be that Python offering a standard library greatly reduces the attack surface over JS. I tend to agree with this, a decently large Flask python app I am working on has 15 entries in requirements.txt (many of which being Flask plugins).

https://www.sonatype.com/blog/pytorch-namespace-dependency-c...

https://socket.dev/blog/pypi-package-disguised-as-instagram-...

https://socket.dev/blog/monkey-patched-pypi-packages-steal-s...

https://socket.dev/blog/malicious-pypi-package-targets-disco...

https://socket.dev/blog/typosquatting-on-pypi-malicious-pack...

Re: PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows

#16

Post by Harmon758 »

blibble wrote: post #12
NeutralForest wrote: post #11

Earlier quoted context omitted.

That's why I stick mostly with Github actions and pin the SHA of the commits instead of the tag version.

yes, it supports it, but it's not the default, is a pain and fills your build file with a load of noise so very few use it it's not made obvious that the tag isn't immutable although you might be happy with the contents of what you've imported right now, who says it won't be malicious in a year's time people inadvertently give full control of their build and all their secrets to whoever controls that repository (now,…

Immutable releases are in public preview and hopefully will make it easier to do the right thing.

https://github.blog/changelog/2025-08-26-releases-now-suppor...

Re: PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows

#17

Post by blibble »

Harmon758 wrote: post #16
blibble wrote: post #12

Earlier quoted context omitted.

yes, it supports it, but it's not the default, is a pain and fills your build file with a load of noise so very few use it it's not made obvious that the tag isn't immutable although you might be happy with the contents of what you've imported right now, who says it won't be malicious in a year's time people inadvertently give full control of their build and all their secrets to whoever controls that repository (now,…

Immutable releases are in public preview and hopefully will make it easier to do the right thing. https://github.blog/changelog/2025-08-26-releases-now-suppor...

I don't see how that solves this problem as long as the attacker can delete and recreate a repository

sigstore's main design goal seems to be to increase the lock-in of of "trusted" providers

(the idea that Microsoft should be trusted for anything requiring any level of security is entirely ludicrous)

Re: PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows

#18

Post by frenchtoast8 »

Harmon758 wrote: post #16
blibble wrote: post #12

Earlier quoted context omitted.

yes, it supports it, but it's not the default, is a pain and fills your build file with a load of noise so very few use it it's not made obvious that the tag isn't immutable although you might be happy with the contents of what you've imported right now, who says it won't be malicious in a year's time people inadvertently give full control of their build and all their secrets to whoever controls that repository (now,…

Immutable releases are in public preview and hopefully will make it easier to do the right thing. https://github.blog/changelog/2025-08-26-releases-now-suppor...

It’s a good first step, but a significant number of GitHub Actions pull a Docker image from a repository such as Docker Hub. In those cases, the GitHub Action being immutable wouldn’t prevent the downstream Docker image from being mutated.

Re: PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows

#19

Post by o11c »

kinow wrote: post #13
nodesocket wrote: post #4

While Python being more widely used than JS, it's interesting the majority of attacks and breaches come from NPM. The consensus seems to be that Python offering a standard library greatly reduces the attack surface over JS. I tend to agree with this, a decently large Flask python app I am working on has 15 entries in requirements.txt (many of which being Flask plugins).

I also think the same. While in Java the stdlib lacks a few functions, long ago Apache Commons became the de-facto complement for the Java stdlib, being replaced/complemented by other libs over time, and eventually even becoming obsolete with newer versions of Java. But I always had the impression that having Apache Software Foundation components (with a good release/security process) helped Java to mitigate a lot of…

Javascript is also hindered by the fact that you have to "pay" for every library you download. This encourages a culture of reinventing the wheel, because "I don't need all that," preventing de-factor stdlib supplements from existing.

Re: PyPI Blog: Token Exfiltration Campaign via GitHub Actions Workflows

#20

Post by darkamaul »

Liskni_si wrote: post #14

If you can change a GitHub Actions workflow to exfiltrate a token, what prevents you from changing the workflow that uses Trusted Publishing to make changes to the package before publishing it? Perhaps by adding an innocent looking use of an external Action?

Nothing.

However, exfiltrating a token is much more easy than modifying the workflow itself. A token is usually simply stored in an env variable.

Post reply on HN