35,000 code repos not hacked—but clones flood GitHub to serve malware

guest · Aug 3, 2022

Github “Supply Chain” Attack
August 3, 2022

Thousands of GitHub repositories were forked (copied) with their clones altered to include malware, a software engineer discovered today.

While cloning open source repositories is a common development practice and even encouraged among developers, this case involves threat actors creating copies of legitimate projects but tainting these with malicious code to target unsuspecting developers with their malicious clones.
GitHub has purged most of the malicious repositories after receiving the engineer's report.
Click to expand...

35,000 GitHub projects not hijacked
Today, software developer Stephen Lacy left everyone baffled when he claimed having discovered a "widespread malware attack" on GitHub affecting some 35,000 software repositories.

Rather, the thousands of backdoored projects are copies (forks or clones) of legitimate projects purportedly made by threat actors to push malware.
Click to expand...

Malicious clones equip attackers with remote access
Developer James Tucker pointed out that cloned repositories containing the malicious URL not only exfiltrated a user's environment variables but additionally contained a one-line backdoor.

Exfiltration of environment variables by itself can provide threat actors with vital secrets such as your API keys, tokens, Amazon AWS credentials, and crypto keys, where applicable.
But, the single-line instruction (line 241 above) further allows remote attackers to execute arbitrary code on systems of all those who install and run these malicious clones.
Click to expand...

GitHub has removed the malicious clones from its platform as of a few hours ago, BleepingComputer can observe.
Click to expand...

guest · Aug 3, 2022

Github “Supply Chain” Attack
August 3, 2022

Just this morning, a significant software “supply chain” attack was discovered in Github, and while the attack was prevented from spreading further, the ramifications of “supply chain” attacks are clear and intimidating.

This recent attack was executed in Github – the most popular code repository used by over 83 million developers across the globe. Their repository allows developers to track and control the source code that they store in the repository. Its users represent the largest coding community in the world.
Click to expand...

In a situation where a developer wants to significantly change the code of another developer, they use Github’s Clone function. This allows a developer to create an exact copy of someone else’s code – where the original version remains untouched under the management of its original author. It retains its existing interaction stats like views, contributions and followers, while the new cloned version is under new ownership with no interaction stats associated with it because essentially it is new code (albeit copied from something existing).
Click to expand...

What happened?
The developers’ community identified the malicious implant within code that was downloaded from Github and immediately the community feared that source code from the original repositories had been infected by this malware. However upon further research it became clear that the infected code was in fact Cloned code which had been downloaded from Github under the assumption that the developer was downloading the original non-malicious repository.

This has potentially catastrophic implications for the software “supply chain” where an unassuming developer mistakenly downloads a cloned code repository which includes malicious code, uses it for their own purposes and then unknowingly provides their users with code that includes malware.
Click to expand...

Log in or Sign up

35,000 code repos not hacked—but clones flood GitHub to serve malware

guest Guest

guest Guest

Log in or Sign up

35,000 code repos not hacked—but clones flood GitHub to serve malware

guest Guest

guest Guest

Useful Searches