malware

Bilingual

Arch Linux disables AUR package adoption
2 months ago
- Arch Linux DevOps team disabled adoption of orphaned packages in the AUR due to malicious package adoptions and follow-up commits.
- The malware is a remote-access trojan (RAT) that communicates over the Tor network and attempts to upload user data.
- New account registration was suspended in June after a similar attack, and reopened on July 13 with ineffective restrictions.
What does GitHub's security team even do?
2 months ago
- GitHub hosts thousands of malware-distributing repositories accessible via standard search, with no special knowledge required.
- These repositories have persisted for two years despite GitHub's resources, security team, and AI capabilities.
- Repositories share common patterns: same structure, emoji in headings, and links to zip archives containing Trojans.
- A search using 'path:readme.md "## Download" ".zip"' identifies many of these repositories, though some legitimate ones appear.
- A refined regular expression search further narrows results to repositories distributing Trojan-laden zip archives.
- GitHub deleted 10,000 repositories found by a published script but took no further action, despite new repositories appearing.
- The author questions why GitHub hasn't proactively used AI or simple searches to continuously block such malware.
Lazarus Group Using Git Hooks to Hide Malware – Open-Source Malware Blog
2 months ago
- Lazarus Group's Contagious Interview and TaskJacker campaigns now hide stage-2 loader in Git hooks instead of .vscode/tasks.json or package.json.
- The malicious pre-commit hook executes automatically when a victim clones a fake coding assessment repo and attempts to commit, downloading a per-platform payload from precommit.vercel.app.
- The hooks use OS fingerprinting (uname -s) to serve different payloads for macOS, Linux, and Windows, and always exit 0 to avoid suspicion.
- The hostname 'precommit.vercel.app' mimics the legitimate pre-commit framework, but is a free Vercel deployment for payload delivery.
- Operators also use post-checkout hooks that fire when switching branches, making the attack even more stealthy.
- Developers are advised to inspect .githooks/, .husky/, .vscode/tasks.json, and postinstall scripts before running any code, preferably in a disposable VM.
- Indicators of compromise include the C2 domain precommit.vercel.app and specific loader SHA-256 hashes, with GitHub search queries provided for threat hunting.
I Inspected My Take-Home Interview Project. It Was a Whole Operation
2 months ago
- Received a LinkedIn message for a Python developer role with an unusually high salary of $10k-$15k/month, raising immediate red flags.
- The take-home assignment was a FastAPI backend with SQLAlchemy; inspection of hidden directories revealed malicious Git hooks.
- The pre-commit hook contained a script that detected the operating system and silently executed a remote payload.
- The payload downloaded secondary scripts, installed Node.js, and ran an obfuscated parser with suspicious dependencies like clipboardy and hardhat, likely targeting crypto wallets.
- Attackers assigned unique IDs to track victims and used a decoy repository cloned from a public project.
- Scanning the attacker's server showed limited vulnerabilities but confirmed the operation was a widespread malware campaign.
RubyGems Supply Chain Attack
2 months ago
- A supply chain attack on RubyGems was discovered via a new gem called git_credential_manager that downloaded malicious binaries from a Forgejo instance.
- The gem evolved over four versions in nine hours, starting as a dropper, then silencing output, and finally executing on library load rather than explicit command.
- The malware avoids CI environments by checking for over 30 environment variables, targeting developer laptops.
- The attacker also compromised other gems (Dendreo and fastlane-plugin-run_tests_firebase_testlab) by adding the malicious gem as a dependency or hijacking accounts.
- Two long-dormant maintainer accounts were reactivated to push the malicious code, highlighting the risk of inactive accounts in package registries.
- This marks RubyGems' first major incident of this type, similar to attacks previously seen on npm and PyPI.

malware

Arch Linux disables AUR package adoption

What does GitHub's security team even do?

Lazarus Group Using Git Hooks to Hide Malware – Open-Source Malware Blog

I Inspected My Take-Home Interview Project. It Was a Whole Operation

RubyGems Supply Chain Attack