Thread by @stephenlacy

I am uncovering what seems to be a massive widespread malware attack on @github.

- Currently over 35k repositories are infected
- So far found in projects including: crypto, golang, python, js, bash, docker, k8s
- It is added to npm scripts, docker images and install docs

Most of these commits seem to be innocuous, with messages such as "bump version to 0.3.11"
github.com/operatino/roni…

Some of these repo histories include commits from the original author, but the commit is not GPG verified:
- github.com/redhat-operato…
And others, the user does not exist:
- github.com/h4v0kr/bitcoin…

Some of these repos were "archived", such as this one in 2019
- github.com/promonlogicali…
- github.com/promonlogicali…

This attack will send the ENTIRE ENV of the script, application, laptop (electron apps), to the attacker's server!

ENVs include:
- Security keys
- AWS access keys
- Crypto keys
... much more

Some of these are obfuscated as legit looking pull requests:
- github.com/pagodabox/nano…
But the repo has not received any PRs
Every single go file in that repo was infected

The attacker creates FAKE orgs/repos and pushes clones of LEGIT projects to github.
For example, this legit crypto miner project:
- github.com/scala-network/…
and the clone:
- github.com/stellitecoin/g…
The original authors then get the blame!

I discovered the exploit as I was reviewing a project I found off a google search.

This is why we don't install random packages off the internet!

I did report this to github, the search phrase for reference is:
- github.com/search?l=YAML&…

Search your code for that URL!

Best mitigation strategy for identifying falsified commits: GPG sign your commits!

Update: The attacker runs arbitrary code on your server once it uploads your env: github.com/promonlogicali…
Thanks @raggi for pointing it out

@raggi I tried curling the endpoint, got zero response

Correction, 35k+ "code hits" on github, not infected repositories.

@github seems to have cleaned up most if not all quite quickly.
Excellent response from them!