News for hackers. Stuff that matters.

A comment on Malicious code added to 35k GitHub repos, leaking user environments.

Re:Malicious code added to 35k GitHub repos, leaking user en... by muppetman on Wednesday August 03, 2022 @01:40AM (#32328031)
How would code like this make it into so many repos? People accepting pull requests and not properly reviewing them? Or is there something even worse about this attack?
[ Parent | on HN ]
Re:Malicious code added to 35k GitHub repos, leaking user en... by stevelacy on Wednesday August 03, 2022 @01:44AM (#32328056)
Many of the repos I found were clones of valid projects with same names under new orgs and new users. For instance, this projects is valid: https://github.com/scala-network/GUI-miner and it's infected clone: https://github.com/stellitecoin/gui-miner

GPG signed commits by the legitimate users do not contain the malware

[ Parent | on HN ]
Re:Malicious code added to 35k GitHub repos, leaking user en... by laserlight on Wednesday August 03, 2022 @03:18AM (#32328608)
Considering that only clones are affected, your original tweet is downright wrong. None of the listed projects (python, js, bash, docker, k8s) are affected. Anybody can fork a repository to introduce malware.
[ Parent | on HN ]
Re:Malicious code added to 35k GitHub repos, leaking user en... by eurasiantiger on Wednesday August 03, 2022 @03:31AM (#32328686)
js is a project?
[ Parent | on HN ]
Re:Malicious code added to 35k GitHub repos, leaking user en... by laserlight on Wednesday August 03, 2022 @04:23AM (#32329049)
You're right. It's not. I just copy-pasted the list from the tweet. I assume that the author meant to write jq.
[ Parent | on HN ]
Re:Malicious code added to 35k GitHub repos, leaking user en... by pcmonk on Wednesday August 03, 2022 @01:43AM (#32328051)
Most of them don't seem to come from pull requests, I wonder if it's paired with a bunch of compromised github accounts?
[ Parent | on HN ]
Re:Malicious code added to 35k GitHub repos, leaking user en... by bonzini on Wednesday August 03, 2022 @02:15AM (#32328230)
Not compromised, just created by the attacker.
[ Parent | on HN ]