Home Cyber Security GitHub Repositories Hit by Password-Stealing Commits Disguised as Dependabot Contributions – Supply:thehackernews.com

GitHub Repositories Hit by Password-Stealing Commits Disguised as Dependabot Contributions – Supply:thehackernews.com

GitHub Repositories Hit by Password-Stealing Commits Disguised as Dependabot Contributions – Supply:thehackernews.com

Supply: thehackernews.com – Author: .

Password-Stealing Commits

A brand new malicious marketing campaign has been noticed hijacking GitHub accounts and committing malicious code disguised as Dependabot contributions with an goal to steal passwords from builders.

“The malicious code exfiltrates the GitHub project’s defined secrets to a malicious C2 server and modify any existing javascript files in the attacked project with a web-form password-stealer malware code effecting any end-user submitting its password in a web form,” Checkmarx said in a technical report.

The malware can also be designed to seize GitHub secrets and techniques and variables to a distant server by way of a GitHub Motion.


The software program provide chain safety agency mentioned it noticed the atypical commits to lots of of private and non-private GitHub repositories between July 8 and 11, 2023.

It has emerged that the victims had their GitHub private entry tokens stolen and utilized by the menace actors to make malicious code commits to customers’ repositories by posing as Dependabot.

It depends is designed to alert customers of safety vulnerabilities in a mission’s dependencies by mechanically generating pull requests to maintain them up-to-date.

Password-Stealing Commits

“The attackers accessed the accounts using compromised PATs (Personal Access Token) — most likely exfiltrated silently from the victim’s development environment,” the corporate mentioned. Most compromised customers are situated in Indonesia.

Nonetheless, the precise methodology by which this theft could have taken place is at the moment unclear, though it’s suspected that it might have concerned a rogue package inadvertently put in by the builders.

The event highlights the continued makes an attempt on a part of menace actors to poison open-source ecosystems and facilitate provide chain compromises.

That is evidenced by a brand new information exfiltration marketing campaign focusing on each npm and PyPI that makes use of as many as 39 counterfeit packages to assemble delicate machine data and transmit the main points to a distant server.


Fight AI with AI — Battling Cyber Threats with Next-Gen AI Tools

Able to deal with new AI-driven cybersecurity challenges? Be a part of our insightful webinar with Zscaler to handle the rising menace of generative AI in cybersecurity.

Supercharge Your Skills

The modules, revealed over a number of days between September 12 and 24, 2023, display a progressive improve in complexity, scope, and obfuscation methods, Phylum said.

The Israeli firm can also be monitoring what it characterised as a big typosquat marketing campaign geared toward npm, during which 125 packages masquerading as angular and react are getting used to ship machine data to a distant Discord channel.

Nonetheless, the exercise seems to be a part of a “research project,” with the writer claiming that it’s performed to “find out if any of the bug bounty programs I’m participating in gets affected by one of the packages so that I could be the first one to notify them and protect their infrastructure.”

“This is in violation of the npm Acceptable Use Policy, and these sorts of campaigns put a strain on individuals tasked with keeping these ecosystems clean,” Phylum cautioned.

Discovered this text attention-grabbing? Observe us on Twitter and LinkedIn to learn extra unique content material we put up.

Unique Submit url: https://thehackernews.com/2023/09/github-repositories-hit-by-password.html

Author: admin
Date: 2023-09-28 18:46:16

Source link


Please enter your comment!
Please enter your name here