Comment by hiciu

3 days ago

Besides main issue here, and the owners account being possibly compromised as well, there's like 170+ low quality spam comments in there.

I would expect better spam detection system from GitHub. This is hardly acceptable.

14 comments

hiciu

Reply
snailmailman  2 days ago

The same thing occurred on the trivy repo a few days ago. A GitHub discussion about the hack was closed and 700+ spam comments were posted.

I scrolled through and clicked a few profiles. While many might be spam accounts or low-activity accounts, some appeared to be actual GitHub users with a history of contributions.

I’m curious how so many accounts got compromised. Are those past hacks, or is this credential steeling hack very widespread?

Are the trivy and litellm hacks just 2 high profile repos out of a much more widespread “infect as many devs as possible, someone might control a valuable GitHub repository” hack? I’m concerned that this is only the start of many supply chain issues.

Edit: Looking through and several of the accounts have a recent commit "Update workflow configuration" where they are placing a credential stealer into a CI workflow. The commits are all back in february.

  • consp  2 days ago

    Once is happenstance. Twice is coincidence. Three times is enemy action.

  • snailmailman  1 day ago

    Update: It looks like the accounts have all been deleted by github, including their repos. They are 404 pages now. Their repos + recent malicious commits are all just 404 pages now.

    I'm curious what the policy is there if the accounts were compromised. Can the original users "restore" their accounts somehow? For now it appears the accounts are gone. Maybe they were entirely bot accounts but a few looked like compromised "real" accounts to me.

    • Fibonar  1 day ago

      Yep my coworker hnykda, first reply confirming the report, got his account deleted for a while earlier. Definitely not the best way of handling this...

fdsjgfklsfd  2 days ago

Reporting spam on GitHub requires you to click a link, specify the type of ticket, write a description of the problem, solve multiple CAPTCHAs of spinning animals, and press Submit. It's absurd.

orf  3 days ago

i'm guessing it's accounts they have compromised with the stealer.

  • ebonnafoux  2 days ago

    They repeat only six sentences during 100+ comments:

    Worked like a charm, much appreciated.

    This was the answer I was looking for.

    Thanks, that helped!

    Thanks for the tip!

    Great explanation, thanks for sharing.

    This was the answer I was looking for.

    • dec0dedab0de  2 days ago

      Over the last ~15 years I have been shocked by the amount of spam on social networks that could have been caught with a Bayesian filter. Or in this case, a fairly simple regex.

      5 replies →