Bilingual

RubyGems Supply Chain Attack
4 days ago
- A supply chain attack on RubyGems was discovered via a new gem called git_credential_manager that downloaded malicious binaries from a Forgejo instance.
- The gem evolved over four versions in nine hours, starting as a dropper, then silencing output, and finally executing on library load rather than explicit command.
- The malware avoids CI environments by checking for over 30 environment variables, targeting developer laptops.
- The attacker also compromised other gems (Dendreo and fastlane-plugin-run_tests_firebase_testlab) by adding the malicious gem as a dependency or hijacking accounts.
- Two long-dormant maintainer accounts were reactivated to push the malicious code, highlighting the risk of inactive accounts in package registries.
- This marks RubyGems' first major incident of this type, similar to attacks previously seen on npm and PyPI.
I Inspected My Take-Home Interview Project. It Was a Whole Operation
2 days ago
- Received a LinkedIn message for a Python developer role with an unusually high salary of $10k-$15k/month, raising immediate red flags.
- The take-home assignment was a FastAPI backend with SQLAlchemy; inspection of hidden directories revealed malicious Git hooks.
- The pre-commit hook contained a script that detected the operating system and silently executed a remote payload.
- The payload downloaded secondary scripts, installed Node.js, and ran an obfuscated parser with suspicious dependencies like clipboardy and hardhat, likely targeting crypto wallets.
- Attackers assigned unique IDs to track victims and used a decoy repository cloned from a public project.
- Scanning the attacker's server showed limited vulnerabilities but confirmed the operation was a widespread malware campaign.
Lazarus Group Using Git Hooks to Hide Malware – Open-Source Malware Blog
18 hours ago
- Lazarus Group's Contagious Interview and TaskJacker campaigns now hide stage-2 loader in Git hooks instead of .vscode/tasks.json or package.json.
- The malicious pre-commit hook executes automatically when a victim clones a fake coding assessment repo and attempts to commit, downloading a per-platform payload from precommit.vercel.app.
- The hooks use OS fingerprinting (uname -s) to serve different payloads for macOS, Linux, and Windows, and always exit 0 to avoid suspicion.
- The hostname 'precommit.vercel.app' mimics the legitimate pre-commit framework, but is a free Vercel deployment for payload delivery.
- Operators also use post-checkout hooks that fire when switching branches, making the attack even more stealthy.
- Developers are advised to inspect .githooks/, .husky/, .vscode/tasks.json, and postinstall scripts before running any code, preferably in a disposable VM.
- Indicators of compromise include the C2 domain precommit.vercel.app and specific loader SHA-256 hashes, with GitHub search queries provided for threat hunting.

Hasty Briefsbeta

#malware

RubyGems Supply Chain Attack

I Inspected My Take-Home Interview Project. It Was a Whole Operation

Lazarus Group Using Git Hooks to Hide Malware – Open-Source Malware Blog