GitHub identified an attack on individual employees of IT companies

[Tomcat]

GitHub has identified a small social engineering campaign targeting the personal accounts of tech firm employees. No GitHub or npm systems were compromised during this campaign, the platform says.

Attackers use a combination of repository prompts and malicious npm package dependencies. Many of these targeted accounts are related to the blockchain, cryptocurrency or online gambling sectors. Several of them belonged to employees of the cybersecurity sectors.

GitHub believes that the campaign was organized by the Jade Sleet or TraderTraitor group, associated with the DPRK. Attackers impersonate developers or recruiters by creating one or more fake accounts on GitHub and other social networks, including LinkedIn, Slack and Telegram. In some cases, hackers use stolen accounts. They may initiate contact on one platform and then try to move the conversation to another.

After making contact, the hacker invites the developer to collaborate on a GitHub repository and convinces him to clone and execute its contents. The repository can be public or private and contains software with malicious npm dependencies. The software may include media players and cryptocurrency trading tools.

Malicious npm packages download and run second-layer software on the victim's computer. GitHub provides a list of domains used for uploading.

An attacker often publishes their malicious packages only when they send a fraudulent invitation to the repository, minimizing the possibility of their verification. In some cases, hackers can deliver malware directly to a messaging or file sharing platform, bypassing the repository invitation step.

The mechanism of the first stage of malware is described in detail in the Phylum Security blog.

GitHub blocked accounts associated with the campaign and published a list of them. The platform sent reports of abuse to domain owners.

Users are advised to review the security log for action:repo.add_member events to determine whether they accepted a repository invitation from one of the hackers. They should also review dependencies and installation scripts. Newly published new packages, scripts, or dependencies that establish network connections during installation must undergo additional testing. Those who may have been targeted by the campaign are encouraged to contact their employer's cybersecurity department. If malicious content was launched, then you need to reset potentially vulnerable devices, change account passwords and tokens stored on the potentially affected device.

Meanwhile, Nautilus security team analyzed a sample of 1.25 million GitHub repositories and found that about 2.95% of them were vulnerable to RepoJacking attacks. They allow attackers to launch supply chain attacks that affect large numbers of users.

 

[Friend]

GitHub under siege: millions of fake stars flood the platform.
The fake shine of the source code misleads inexperienced developers.

Researchers from Socket have found 3.7 million fake GitHub Stars on GitHub, indicating an increase in fraud and the spread of malware on the popular developer platform. Over the past six months, the problem has increased rapidly.

Stars on GitHub are often the first indicator of a project's popularity, but due to fraudulent schemes, this is no longer a reliable criterion. Fake stars are sold for as little as 10 cents, which turns them into a tool to deceive users and investors. And while GitHub prohibits automated bulk activity and fake accounts, these activities are still widespread.

The main danger of such stars is fraudulent repositories that are disguised as popular projects and contain malicious code. For example, some of these repositories aim to steal cryptocurrencies through hidden commands. Other risks include attracting venture capital investments to companies with fake popularity indicators, which leads to financial losses for unsuspecting investors.

In addition, fake stars increase the ranking of low-quality repositories, such as lists of code examples or templates, which clogs up GitHub and confuses novice programmers.

Despite GitHub's efforts to remove such repositories, the problem remains: 11% of dubious repositories remain active, and 28 of them have been flagged as containing malware.

The algorithm used to identify the fake stars is based on an analysis of GitHub data over the past five years. With its help, it was possible to identify more than 10 thousand repositories with suspicious stars. GitHub has already removed nearly 90% of these repositories, but there are still thousands that may contain malware or simply be unscrupulous projects.

The researchers suggest that users be careful and check the repositories, not trusting only the number of stars. A new suspicious star notification system was also launched on the platform, which helps identify potentially dangerous projects and prevent risks in the software supply chain.

The situation with GitHub stars vividly illustrates how even the most reliable indicators of trust can be compromised these days. It reminds us of the need for constant vigilance and critical thinking in an online environment where the appearance of popularity does not always reflect true value or safety.