Malicious code added to 35k GitHub repos, leaking user environments
1–10 of 79 posts
Re: Malicious code added to 35k GitHub repos, leaking user environments
#2They have attacks for different programming languages and environments. So not just a single target (e.g. npm) attack.
Re: Malicious code added to 35k GitHub repos, leaking user environments
#3How would code like this make it into so many repos? People accepting pull requests and not properly reviewing them? Or is there something even worse about this attack?
Re: Malicious code added to 35k GitHub repos, leaking user environments
#4How would code like this make it into so many repos? People accepting pull requests and not properly reviewing them? Or is there something even worse about this attack?
Most of them don't seem to come from pull requests, I wonder if it's paired with a bunch of compromised github accounts?
Re: Malicious code added to 35k GitHub repos, leaking user environments
#5How would code like this make it into so many repos? People accepting pull requests and not properly reviewing them? Or is there something even worse about this attack?
Many of the repos I found were clones of valid projects with same names under new orgs and new users.
For instance, this projects is valid: https://github.com/scala-network/GUI-miner
and it's infected clone: https://github.com/stellitecoin/gui-miner
GPG signed commits by the legitimate users do not contain the malware
Re: Malicious code added to 35k GitHub repos, leaking user environments
#6Oh dear. This is a gigantic disaster.
If lots of software released today haven't been pinning their versions on release (especially Electron apps) or signing their commits if they are open-source, then this is a chaotic supply chain attack waiting to happen and is more worse than I thought.
But really it is yet, another reason to avoid GitHub entirely and just self-host using GitLab or Gitea.
Re: Malicious code added to 35k GitHub repos, leaking user environments
#7This is that thing where people can put anyone in as the commit author, thus impersonating the original creator right?
Seems like the solution is "don't just copy random github urls into your code" ?
Re: Malicious code added to 35k GitHub repos, leaking user environments
#8This is that thing where people can put anyone in as the commit author, thus impersonating the original creator right? Seems like the solution is "don't just copy random github urls into your code" ?
Correct. My suggestion for a solution is for github to add a "reject-unsigned" feature. Only allow commits signed by and to be pushed to github, under any projects/org.
Re: Malicious code added to 35k GitHub repos, leaking user environments
#9This is that thing where people can put anyone in as the commit author, thus impersonating the original creator right? Seems like the solution is "don't just copy random github urls into your code" ?
Correct. My suggestion for a solution is for github to add a "reject-unsigned" feature. Only allow commits signed by and to be pushed to github, under any projects/org.
I like it, although raises the bar for contributors to join.
Also does not help that enough percentage of repo owners would accept then signed PRs to their projects.
The fake accounts can be created with gpg signed fake commits too.
Re: Malicious code added to 35k GitHub repos, leaking user environments
#10Oh dear. This is a gigantic disaster. If lots of software released today haven't been pinning their versions on release (especially Electron apps) or signing their commits if they are open-source, then this is a chaotic supply chain attack waiting to happen and is more worse than I thought. But really it is yet, another reason to avoid GitHub entirely and just self-host using GitLab or Gitea.
The last paragraph is orthogonal to the problem that an npm install poses here, wherever your repo is.