News for hackers. Stuff that matters.

A comment on Malicious code added to 35k GitHub repos, leaking user environments. Parent comment

Re:Malicious code added to 35k GitHub repos, leaking user en... by ache7 on Wednesday August 03, 2022 @02:50AM (#32328443)
Here is a commit with malicious code from a Microsoft employee:

https://github.com/promonlogicalis/asn1/commit/7bdca06d0edf8...

[ Parent | on HN ]
Re:Malicious code added to 35k GitHub repos, leaking user en... by raggi on Wednesday August 03, 2022 @02:53AM (#32328463)
That commit was rewritten from https://github.com/Logicalis/asn1/commit/d60463189a563e49f19... which was signed, but is not in the fork.
[ Parent | on HN ]
Re:Malicious code added to 35k GitHub repos, leaking user en... by ache7 on Wednesday August 03, 2022 @03:02AM (#32328523)
Damn, github should show some big visible warning about this.
[ Parent | on HN ]
Re:Malicious code added to 35k GitHub repos, leaking user en... by 3np on Wednesday August 03, 2022 @03:10AM (#32328562)
As long as the commit is not signed (marked green), that means nothing.
[ Parent | on HN ]
Re:Malicious code added to 35k GitHub repos, leaking user en... by vladvasiliu on Wednesday August 03, 2022 @02:57AM (#32328484)
This is interesting. If you go to that user's profile, and look at the "contributions", there are none in July / August. Yet the commit is from two days ago.
[ Parent | on HN ]