I found 10k GitHub repositories distributing Trojan malware • Hacker News Board

Re: I found 10k GitHub repositories distributing Trojan malware

#201

Post by ponector » Fri, Jun 19, 2026, 6:34 AM UTC

bigiain wrote: post #166

bartread wrote: post #162

Earlier quoted context omitted.

It becomes tricky when all your passwords are randomly generated, 24 characters long, full of symbols, special characters, casing variations, etc. All of mine are an absolute nightmare to type manually. I suppose that becomes a pretty strong argument for passphrases + MFA, because passphrases are much easier to type in manually. But the problem there is lots of services still have stupid/arbitrary maximum password le…

You can generate "pronounceable" passwords in some tools. 1PW just generated this for me: mimp-rort-jan-mon-kain-sqin Not as much entropy as 24 random letters/digit/punctuations/capitalisation. But (for me at least) much easier to read end type in situations where copy/paste isn't available (like from my phone to my dev docker containers)

>> mimp-rort-jan-mon-kain-sqin And then you see they are not accepting such a weak password. Add special characters, numbers, etc.

Re: I found 10k GitHub repositories distributing Trojan malware

#202

Post by CapsAdmin » Fri, Jun 19, 2026, 6:54 AM UTC

emodendroket wrote: post #176

CapsAdmin wrote: post #26

Earlier quoted context omitted.

This is my takeaway as well. Having the source code open makes it auditable, if not by you, maybe the community. The free software license specifically gives the software an extra advantage in that changes to the software must be shared openly, if distributed as as binaries.

I know. But the problem is that in reality the only way to get people to audit software reliably is to pay them to do it, so it's not really true as a general principle that open-source software is more thoroughly vetted.

I'd say it's objectively true to say that open source software is easier to audit compared to closed source software, which you can extrapolate to mean that it's less prone to malicious code injection.

It's not perfect, but surely it's easier to audit for malicious code than closed source.

Also, there is no shortage of volunteers looking out for code changes in established open source software. I think it's fair to exclude software that is very new and/or that has no users, which may be closer to equal footing with proprietary software.

Even for established proprietary software, you get volunteers watching out for changes in releases. Though, far less than open source, and more reserved for people who know reverse engineering.

Re: I found 10k GitHub repositories distributing Trojan malware

#203

Post by SCdF » Fri, Jun 19, 2026, 7:02 AM UTC

vintermann wrote: post #183

guhcampos wrote: post #81

> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…

Political manipulation is a problem, but I don't think it's nearly as profitable as pushing scams and gambling.

It's more profitable because it allows you to select political perspectives that allow you, the scammer and or gambler, to scam or gamble harder.

Re: I found 10k GitHub repositories distributing Trojan malware

#204

Post by codedokode » Fri, Jun 19, 2026, 7:09 AM UTC

realusername wrote: post #198

codedokode wrote: post #195

Earlier quoted context omitted.

In Linux there is no vetting. Does anyone verify proprietary AI agents like Claude Code? Software like VS Code? Games? They are distributed through random sites and cannot even be banned. You could restrict yourself to the official repositories, but there is a limited selection of software. There are no closed-source software, like audio editing plugins, graphic editors, games, AI agents and so on. Even open-source s…

There's vetting, apps like Facebook or Candy Crush would never past the most basic repository scrutiny if you made it Linux native and would never be included anywhere, even if they were made open source. You can constrast that with the Play Store where just searching for ChatGPT brings you a fake app on top (and before you bring the appstore, it was the same there until they banned the keyword after some bad press)…

The point is, for many use cases you need to install third-party software, including closed-source software, and I want an OS to be able to run it safely. That's the purpose of OS - allow running software.

In reality, third-party software like Docker or Node.JS typically suggests that you sudo-curl-bash the script from the Internet. How worse could it be.

Re: I found 10k GitHub repositories distributing Trojan malware

#205

Post by WalterBright » Fri, Jun 19, 2026, 7:10 AM UTC

pksebben wrote: post #180

WalterBright wrote: post #177

Earlier quoted context omitted.

A password manager is a single point of failure and should be avoided. I've heard other sad stories about someone who's pw manager was compromised and they lost everything.

out of curiosity - what scheme do you suggest? I've always been of the mind that 'one thing to remember and secure, but secure it well' was the best option - 2factor and a 15+character passphrase meaning that nearly everything else gets it's own discretized blast radius. Always open to better security, though.

Have a different password for every account, and don't store them on your computer.

Re: I found 10k GitHub repositories distributing Trojan malware

#206

Post by Cthulhu_ » Fri, Jun 19, 2026, 7:33 AM UTC

saidnooneever wrote: post #194

guhcampos wrote: post #81

> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…

2 is full on speculation. It can be any kind of purpose.

Yes, a lot of compromised accounts are just put onto a marketplace of sorts, either selling the account itself directly or offered as services to promote a product / political talking point / propaganda / engagement.

Re: I found 10k GitHub repositories distributing Trojan malware

#207

Post by Cthulhu_ » Fri, Jun 19, 2026, 7:34 AM UTC

vintermann wrote: post #183

guhcampos wrote: post #81

> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…

Political manipulation is a problem, but I don't think it's nearly as profitable as pushing scams and gambling.

You'd be surprised as how there's individuals and organizations willing to pay a lot of money to do political manipulation / influencing.

Re: I found 10k GitHub repositories distributing Trojan malware

#208

Post by codedokode » Fri, Jun 19, 2026, 7:36 AM UTC

mittensc wrote: post #200

codedokode wrote: post #193

Earlier quoted context omitted.

I thought about VM but it would be pretty expensive and require lot of RAM (which is not cheap nowadays and not always upgradeable on laptops. How would you upgrade your 8 Gb MacBook?) and CPU overhead to emulate the hardware and run one more kernel. The program in VM would not be able to use OpenGL/Vulkan, access the audio card with low latency (for working with audio), connect to DBus (to interact with other softwa…

> Neither SELinux not AppArmor allows to show a question "would you like to allow program N to access your microphone" Permissions on microphone device would work, build your own UI / virtual device or generate one with claude if you really want popups. > "would you like to let the program connect to github.com? (Yes) (No) (With decrypting SSL traffic)"." I actually have something for this. Firewall everything blocke…

How do you sandbox /proc by the way? So that the app doesn't crash due to missing /proc/self/exe link or /proc/ID/stat file, but cannot read my private information (like /proc/cmdline, /proc/mounts etc)? Things like bind mounts do not work on /proc.

I ended up with writing a FUSE-based emulation in Python, but there are lot of issues with permissions and namespaces:

- I could run my /proc emulator in the same PID namespace as the target, but in a different mount namespace so that I can mount real /proc there. This is not safe because the target could send signals or ptrace my emulator and gain access to the real /proc. Especially if it is an AI agent, they are pretty capable.

- I could run the emulator in a different mount and PID namespaces but then the emulator needs to translate PIDs into the target namespace, and for this I need to know the format of all files and where they contain PIDs and it is a pain

- running the poorly coded emulator as a root is not an option. The sandbox must work without root.

- ideally the emulator should run as a different user because Linux provides the strongest isolation for processes of different users, but in this case I won't be able to access target's /proc entries.

Also, running a program is the most basic functionality of an OS and you suggest that I need to write my own sandbox to do this because it is not included with Linux. Maybe that is why this year still is not the year of Linux on desktop.

Re: I found 10k GitHub repositories distributing Trojan malware

#209

Post by eru » Fri, Jun 19, 2026, 7:42 AM UTC

saidnooneever wrote: post #194

guhcampos wrote: post #81

> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…

2 is full on speculation. It can be any kind of purpose.

Or it could just be that someone vibe coded the worm, and vibe coding is relatively young.

Re: I found 10k GitHub repositories distributing Trojan malware

#210

Post by netsharc » Fri, Jun 19, 2026, 7:48 AM UTC

nine_k wrote: post #185

vintermann wrote: post #183

Earlier quoted context omitted.

Political manipulation is a problem, but I don't think it's nearly as profitable as pushing scams and gambling.

I suspect that politicians right before elections may pay more than standard gambling. They gamble with much higher stakes.

Hah, outsourcing political "influencing" to tiny "consulting" companies that promise great things but is a rickety AI slop shop in the backend.

I suppose the only difference to the Big 4 is the price tag.

I guess politicians could claim to be hiring a voter research company and profess to be oblivious to the "voter hacking" schemes (hacking the voters' minds to lean whichever way the politician wants them to lean).