I found 10k GitHub repositories distributing Trojan malware • Hacker News Board

Re: I found 10k GitHub repositories distributing Trojan malware

#131

Post by embedding-shape » Thu, Jun 18, 2026, 8:26 PM UTC

criddell wrote: post #127

tedd4u wrote: post #80

Earlier quoted context omitted.

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

On Linux, would something like Snap or Flatpak have protected them? It seems nuts that a random executable should have access to the password service.

Ultimately it depends on the exact mechanism here, maybe the tool/README said "Run sudo ./setup-deps" and they followed it, or something similar, not sure any sort of software isolation would have helped at that point.

Re: I found 10k GitHub repositories distributing Trojan malware

#132

Post by embedding-shape » Thu, Jun 18, 2026, 8:29 PM UTC

8cvor6j844qw_d6 wrote: post #102

tedd4u wrote: post #80

Earlier quoted context omitted.

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

> Strong support for the strategy of not putting your TOTP/MFA in your password manager Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. A password manager + built-in TOTP on a dedic…

> Agreed, but I think using the same device to access your password manager and for dev

Almost all development I do, and most others, are on our projects or projects we're at least interested in, and most likely dove into, that's why we're developing in them in the first place.

In this case, it seems like the developer wasn't actually developing anything, but playing around with image generation on his time off, for fun, and ended up pulling down a random 3rd party thing and got compromised that way. Very different from "for dev" I'd say.

Besides, didn't most developer start isolating projects from each other when the first npm worms started to appear? I know I stopped running `npm install` in the same environment I do my banking, and drastically reduced the amount of random 3rd party stuff I have, still use all the same device though. Even have a Windows install on the same computer, booo!

Re: I found 10k GitHub repositories distributing Trojan malware

#133

Post by doctorpangloss » Thu, Jun 18, 2026, 8:29 PM UTC

ptx wrote: post #34

emodendroket wrote: post #8

I have to say, the principle that open-source software can't do anything nefarious because the source is open just hasn't held up for a lot of reasons -- including that nobody has the time to inspect the code, let alone ensure that it matches the binaries; and also that GitHub has become a distribution hub for software used by lots of people with no ability or interest in auditing the software they use.

The problem the article is describing seems to have little to do with open source. There were GitHub repositories that had links added in their READMEs to a zip file containing compiled binaries. GitHub is not a curated software repository. It's essentially no different from some random stranger linking to some binaries on a forum. (There are communities that seem to have no concerns about running unknown binaries fr…

there are numerous OSS maintainers who have turned GitHub into a religion. the maintainers of bevy and brew come to mind. it is a "curated software repository" and so much more, it's practically a way of life for these guys.

Re: I found 10k GitHub repositories distributing Trojan malware

#134

Post by pixl97 » Thu, Jun 18, 2026, 8:31 PM UTC

rozab wrote: post #109

mustaphah wrote: post #103

This is just one flavour of abuse. GitHub does NOT give a shit about the scale of the malware problem. I've seen so many forms of malware repos working on a GitHub trends newsletter [1], mostly about crypto, NFTs, KMS, and similar stuff. In the first runs of the project, I was so surprised by tens of malware repos that looked like trending repos. A lot of them share some common traits that made filtering feasible: -…

If most malware repos are created in the last few days by a fresh user, then it sounds like GitHub is taking action against them? Or where are the old ones?

Yea, I'd change it to, they care about the malware and will remove the repos, but above everything else they don't want to slow down the signup flow

Re: I found 10k GitHub repositories distributing Trojan malware

#135

Post by [deleted] » Thu, Jun 18, 2026, 8:34 PM UTC

rozab wrote: post #109

mustaphah wrote: post #103

This is just one flavour of abuse. GitHub does NOT give a shit about the scale of the malware problem. I've seen so many forms of malware repos working on a GitHub trends newsletter [1], mostly about crypto, NFTs, KMS, and similar stuff. In the first runs of the project, I was so surprised by tens of malware repos that looked like trending repos. A lot of them share some common traits that made filtering feasible: -…

If most malware repos are created in the last few days by a fresh user, then it sounds like GitHub is taking action against them? Or where are the old ones?

[deleted]

Re: I found 10k GitHub repositories distributing Trojan malware

#136

Post by mustaphah » Thu, Jun 18, 2026, 8:40 PM UTC

frereubu wrote: post #129

mustaphah wrote: post #103

This is just one flavour of abuse. GitHub does NOT give a shit about the scale of the malware problem. I've seen so many forms of malware repos working on a GitHub trends newsletter [1], mostly about crypto, NFTs, KMS, and similar stuff. In the first runs of the project, I was so surprised by tens of malware repos that looked like trending repos. A lot of them share some common traits that made filtering feasible: -…

I have no idea of the kind of investment this would take in terms of time and money, but is it beyond the realms of possibility to run code submitted to GitHub through a basic filter? Genuine question - I have no experience of systems at that scale. But the fact that Microsoft is able to replace URLs in emails with ones that redirect through their systems so they can block malware URLs makes me feel like it should be…

You can probably catch a big pie of those with simple heuristics to flag suspicious repos for expensive review (human- or AI-based). I did that with public account & repo data, and I believe they can do much more given the amount of private data they have access to.

I'm talking about 10s of repos flagged in a few hours. I don't think the volume would be that big for an expensive review.

Re: I found 10k GitHub repositories distributing Trojan malware

#137

Post by captn3m0 » Thu, Jun 18, 2026, 8:52 PM UTC

8cvor6j844qw_d6 wrote: post #102

tedd4u wrote: post #80

Earlier quoted context omitted.

Strong support for the strategy of not putting your TOTP/MFA in your password manager, which has been argued on HN in the past.

> Strong support for the strategy of not putting your TOTP/MFA in your password manager Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. A password manager + built-in TOTP on a dedic…

> I don't think there exist a password manager that is explicitly designed for a compromised/hostile device.

The crypto people tried this with hardware only password managers but they were too annoying. I have a halfway solution of using pass with Yubikey/GPG where each password decryption requires a touch. It does protect against the entire vault being decrypted at once and exfiltrated.

Re: I found 10k GitHub repositories distributing Trojan malware

#138

Post by gleenn » Thu, Jun 18, 2026, 9:03 PM UTC

frereubu wrote: post #129

mustaphah wrote: post #103

This is just one flavour of abuse. GitHub does NOT give a shit about the scale of the malware problem. I've seen so many forms of malware repos working on a GitHub trends newsletter [1], mostly about crypto, NFTs, KMS, and similar stuff. In the first runs of the project, I was so surprised by tens of malware repos that looked like trending repos. A lot of them share some common traits that made filtering feasible: -…

I have no idea of the kind of investment this would take in terms of time and money, but is it beyond the realms of possibility to run code submitted to GitHub through a basic filter? Genuine question - I have no experience of systems at that scale. But the fact that Microsoft is able to replace URLs in emails with ones that redirect through their systems so they can block malware URLs makes me feel like it should be…

It exists, although people complain it is too noisy. You can hook in any if your own tools too.

https://github.blog/security/how-to-scan-for-vulnerabilities...

Re: I found 10k GitHub repositories distributing Trojan malware

#139

Post by cuu508 » Thu, Jun 18, 2026, 9:08 PM UTC

deepsun wrote: post #118

8cvor6j844qw_d6 wrote: post #102

Earlier quoted context omitted.

> Strong support for the strategy of not putting your TOTP/MFA in your password manager Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. A password manager + built-in TOTP on a dedic…

But it's a hassle to have at least 2 yubikeys in case you lose one. And since you regularly sign up for new websites with OTPs, gotta keep them in sync. So always carry both with you. And if you carry both, then it's easy to lose both at the same time. UPDATE: also gotta keep track separatelt of non-resident passkeys tied to Yubikey, because Yubikey doesn't know where it was used for non-resident. If you lose one yub…

I add a note in the password manager's notes field for sites where I've added Yubikeys as the second factor. I can get the list of the sites using search, and from time to time I go through them to check if a backup key needs to be registered. I create new accounts infrequently.

Re: I found 10k GitHub repositories distributing Trojan malware

#140

Post by embedding-shape » Thu, Jun 18, 2026, 9:10 PM UTC

captn3m0 wrote: post #137

8cvor6j844qw_d6 wrote: post #102

Earlier quoted context omitted.

> Strong support for the strategy of not putting your TOTP/MFA in your password manager Agreed, but I think using the same device to access your password manager and for dev is asking for trouble in the first place. Password managers assumes a non-compromised device. I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. A password manager + built-in TOTP on a dedic…

> I don't think there exist a password manager that is explicitly designed for a compromised/hostile device. The crypto people tried this with hardware only password managers but they were too annoying. I have a halfway solution of using pass with Yubikey/GPG where each password decryption requires a touch. It does protect against the entire vault being decrypted at once and exfiltrated.

> tried this with hardware only password managers but they were too annoying

And besides that, ultimately if the computer you're using been compromised, whatever you do on that computer can be mucked about with, so while the password sits safely on the hardware, once you're logged in in the browser, the cookie is just sitting there. I guess you'd get furthest isolation with Qubes et al, but with a regular Linux installation you'd still be exposed with a hardware password manager, if the installation been compromised.