News for hackers. Stuff that matters.

A comment on Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem. Parent comment

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by benoau on Sunday December 14, 2025 @09:32AM (#46263280)
You can set up your repo to disable pushing directly to branches like main and require MFA to use the org admin account, so something malicious would need to push to a benign branch and separately be merged into one that deploys come from.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by t0mas88 on Sunday December 14, 2025 @10:44AM (#46263844)
But the attacker could just create a branch, merge request and then merge that?
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by benoau on Sunday December 14, 2025 @12:51PM (#46265095)
They can't with git by itself, but if you're also signed in to GitHub or BitBucket's CLI with an account able to approve merges they could use those tools.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by x0x0 on Sunday December 14, 2025 @01:52PM (#46265653)
We require review on PRs before they can be merged.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by sallveburrpi on Sunday December 14, 2025 @09:45AM (#46263370)
Pushing directly to main seems crazy - for anything that is remotely important I would use a pull request/merge request pattern
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by esseph on Sunday December 14, 2025 @10:00AM (#46263498)
Depends on the use case of the repo.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by otterley on Sunday December 14, 2025 @02:21PM (#46265917)
There's nothing wrong with pushing to main, as long as you don't blindly treat the head of the main branch as production-ready. It's a branch like any other; Git doesn't care what its name is.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by sallveburrpi on Sunday December 14, 2025 @08:49PM (#46269421)
Yea ofc I was implying that main is the branch that is pushed to production.
[ Parent | on HN ]