Stories with Tag malicious code

• Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos

  permalink

  Posted: 2025-03-14 22:29:46

  Verbose tl;dr

  The popular GitHub Action tj-actions/changed-files was compromised and used to inject malicious code into projects that utilized it. The attacker gained access to the action's repository and added code that exfiltrated environment variables, secrets, and other sensitive information during workflow runs. This action, used by over 23,000 repositories, became a supply chain vulnerability, potentially affecting numerous downstream projects. The maintainers have since regained control and removed the malicious code, but users are urged to review their workflows and rotate any potentially compromised secrets.

  The blog post "Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos" by Step Security details a security incident involving a popular GitHub Action, tj-actions/changed-files, which was compromised and used to inject malicious code into the build processes of repositories that depended on it. This action, utilized by over 23,000 repositories, provided a convenient way to identify files changed in a given commit, a common requirement for optimizing workflows.

  The attacker gained control of the tj-actions/changed-files repository by compromising the maintainer's account. They then introduced a malicious commit, specifically version 3.6.0, that included a backdoor. This backdoor injected a malicious script, ./setup.sh, disguised as a harmless setup script. When the compromised action was executed, this script would download and execute a second-stage payload from a remote server controlled by the attacker. This second payload was capable of exfiltrating sensitive information, such as environment variables, secrets, and repository contents, from the affected workflows.

  The blog post emphasizes the severe security implications of this type of supply chain attack, where a compromised dependency can affect a large number of downstream users. It highlights the importance of verifying the integrity and provenance of third-party actions before incorporating them into CI/CD pipelines.

  The post outlines several mitigation strategies for those who may have used the compromised version. These include immediately reviewing workflow logs for suspicious activity, rotating any potentially exposed secrets, and pinning the action to a known safe version (such as 3.5.1 or earlier) or migrating to an alternative solution. The post specifically suggests the dorny/paths-filter action as a secure replacement.

  Furthermore, the article discusses broader best practices for securing GitHub Actions workflows. It recommends using OpenID Connect (OIDC) to limit the need for long-lived secrets, enabling branch protection rules to prevent unauthorized modifications to workflows, and adopting least-privilege access for GitHub Actions tokens. It also advocates for the development of mechanisms to detect anomalous behavior in workflows and alert administrators to potential compromises, such as unexpected network connections or the execution of unfamiliar scripts. The incident underlines the critical need for continuous vigilance and proactive security measures in the software supply chain.

  • GitHub
  • GitHub Actions
  • Security
  • Software Supply Chain Security
  • Supply Chain Attack
  • Compromised Action
  • tj-actions/changed-files
  • Software Security
  • Cybersecurity
  • Open Source Security
  • Dependency Security
  • Vulnerability
  • malicious code
  • code injection
  • Security Best Practices
  • Security Alert

  Summary of Comments ( 205 )
  https://news.ycombinator.com/item?id=43367987

  Verbose tl;dr

  Hacker News users discussed the implications of the tj-actions/changed-files compromise, focusing on the surprising longevity of the vulnerability (2 years) and the potential impact on the 23,000+ repositories using it. Several commenters questioned the security practices of relying on third-party GitHub Actions without thorough vetting, emphasizing the need for auditing dependencies and using pinned versions. The ease with which a seemingly innocuous action could be compromised highlighted the broader security risks within the software supply chain. Some users pointed out the irony of a security-focused action being the source of vulnerability, while others discussed the challenges of maintaining open-source projects and the pressure to keep dependencies updated. A few commenters also suggested alternative approaches for achieving similar functionality without relying on third-party actions.

  The Hacker News post discussing the compromise of the tj-actions/changed-files GitHub Action has a substantial number of comments exploring various facets of the incident and its implications.

  Several commenters discuss the nature of the vulnerability and the attacker's approach. Some point out the seemingly unsophisticated nature of the attack, highlighting the injected code's straightforward execution of a malicious payload without much obfuscation or stealth. Others analyze the specific mechanism of the compromise, noting how the attacker gained access to the maintainer's account and modified the action to include the malicious script. The relative ease with which this popular action was compromised raises concerns about the security of the software supply chain and the potential for similar attacks in the future.

  A significant thread of discussion revolves around the responsibilities of open-source maintainers and the challenges they face. Commenters acknowledge the substantial workload often borne by maintainers who volunteer their time and expertise. The incident underscores the difficulty of securing open-source projects, particularly those with a large user base, and the potential consequences of compromised dependencies. Some suggest potential solutions, including increased scrutiny of third-party actions, improved security practices for maintainers, and the development of tools to detect malicious code in actions. The discussion also touches upon the financial aspect of open-source maintenance and the need for better support and resources for maintainers.

  Several users express frustration with GitHub's handling of the situation, particularly the perceived lack of communication and transparency. Some commenters criticize the platform's security measures and suggest improvements, such as stricter verification processes for actions and more robust mechanisms for detecting and responding to compromises. Others point out the difficulty of verifying the integrity of third-party code and the need for better tools and practices to address this challenge.

  The impact of the compromise on the broader software ecosystem is also a topic of discussion. Commenters speculate on the potential consequences for the thousands of repositories that rely on the affected action, including the possibility of data breaches and other security incidents. The incident highlights the interconnected nature of the software supply chain and the potential for widespread damage from a single compromised component. Some users share their experiences dealing with the fallout from the incident, including the steps they took to mitigate the risk and ensure the security of their projects.

  Finally, there's a thread discussing the importance of supply chain security in general and the need for increased vigilance and proactive measures to protect against similar attacks in the future. Commenters suggest various strategies, including code signing, multi-factor authentication, and regular security audits. The incident serves as a wake-up call for the software development community, emphasizing the need for a more robust and secure approach to managing dependencies and protecting the software supply chain.

• Fake VS Code Extension on NPM Spreads Multi-Stage Malware

  permalink

  Posted: 2025-02-07 06:58:10

  Verbose tl;dr

  A malicious VS Code extension masquerading as a legitimate "prettiest-json" package was discovered on the npm registry. This counterfeit extension delivered a multi-stage malware payload. Upon installation, it executed a malicious script that downloaded and ran further malware components. These components collected sensitive information from the infected system, including environment variables, running processes, and potentially even browser data like saved passwords and cookies, ultimately sending this exfiltrated data to a remote server controlled by the attacker.

  A malicious Visual Studio Code extension masquerading as a legitimate package, "LaTeX Workshop," has been discovered on the Node Package Manager (NPM) registry. This counterfeit extension, subtly named "latex-workshop," utilized typosquatting, a technique relying on common spelling errors, to deceive developers into downloading it instead of the genuine "LaTeX Workshop" extension. This malicious package represents a sophisticated multi-stage malware attack, designed to evade detection and compromise affected systems.

  Upon installation, the counterfeit extension executes a preinstall script. This script downloads a password-protected ZIP archive hosted on a Discord server, further obfuscating its malicious intent and making traditional static analysis more difficult. The use of a Discord server for hosting malicious payloads is a notable tactic, leveraging the platform's widespread use and potentially bypassing security measures focused on more typical malware distribution channels.

  The downloaded ZIP archive contains the primary payload, an obfuscated JavaScript file. This obfuscation technique makes it harder for security researchers and automated tools to understand the code’s functionality, thereby delaying detection and analysis. The malware also utilizes techniques to identify the infected machine's operating system, allowing it to download and execute a second-stage payload tailored to either Windows or macOS/Linux environments. This targeted approach increases the effectiveness of the malware and maximizes its potential impact.

  On Windows systems, the second-stage payload attempts to steal sensitive information, including stored browser credentials, system information, and details from cryptocurrency wallets. This data exfiltration targets valuable user data that can be exploited for financial gain or identity theft. On macOS and Linux systems, the second-stage payload employs a Python-based information stealer to achieve a similar goal, highlighting the attacker's cross-platform ambitions and sophistication.

  The discovery of this malicious extension underscores the ongoing risks associated with software supply chain attacks. By infiltrating a trusted repository like NPM, malicious actors can target a large number of developers and potentially compromise a significant number of systems. The use of multi-stage payloads, obfuscation, and typosquatting demonstrates the increasing complexity of these attacks and highlights the need for heightened vigilance and robust security measures within the software development lifecycle. Developers are strongly encouraged to meticulously verify the authenticity of extensions and packages before installation, paying close attention to package names and publisher details to avoid falling victim to these deceptive tactics. Furthermore, utilizing reputable security tools and staying informed about the latest threat landscape is crucial for mitigating the risks posed by such malicious software.

  • npm
  • Malware
  • visual studio code
  • VS Code
  • VS Code extensions
  • Security
  • Cybersecurity
  • software supply chain
  • Supply Chain Security
  • Software Security
  • multi-stage malware
  • malicious code
  • code injection
  • extension security
  • IDE security
  • developer tools security

  Summary of Comments ( 63 )
  https://news.ycombinator.com/item?id=42970169

  Verbose tl;dr

  Hacker News commenters discuss the troubling implications of malicious packages slipping through npm's vetting process, with several expressing surprise that a popular IDE extension like "Prettier" could be so easily imitated and used to distribute malware. Some highlight the difficulty in detecting sophisticated, multi-stage attacks like this one, where the initial payload is relatively benign. Others point to the need for improved security measures within the npm ecosystem, including more robust code review and potentially stricter publishing guidelines. The discussion also touches on the responsibility of developers to carefully vet the extensions they install, emphasizing the importance of checking publisher verification, download counts, and community feedback before adding any extension to their workflow. Several users suggest using the official VS Code Marketplace as a safer alternative to installing extensions directly via npm.

  The Hacker News post "Fake VS Code Extension on NPM Spreads Multi-Stage Malware" has generated a number of comments discussing the incident and its implications.

  Several commenters express concern over the increasing prevalence of malicious packages on npm, highlighting the difficulty in vetting every extension or dependency. They point out that the open-source nature of the ecosystem and the ease of publishing packages make it a prime target for malicious actors. This incident further fuels the ongoing discussion about improving security measures on npm, including better verification and detection mechanisms.

  One commenter mentions the potential effectiveness of sandboxing extensions, suggesting it as a crucial step in mitigating the impact of such malware. This idea resonates with others who advocate for stronger isolation between extensions and the core editor to limit the potential damage.

  Some users discuss the specific tactics used in this attack, like typosquatting (using a slightly misspelled package name) and the multi-stage delivery mechanism of the malware, emphasizing the sophistication and deliberate effort involved. They point to the need for developers to be more vigilant in checking package details before installation, including examining the publisher, download counts, and community feedback.

  The discussion also touches upon the responsibility of repository maintainers like npm to implement more robust security measures. Suggestions include more stringent vetting processes for new packages, enhanced malware detection algorithms, and potentially even reputation systems for publishers.

  One commenter wryly observes that the irony of a malware-laden extension aimed at developers who are, in theory, more security-conscious highlights the insidious nature of these threats.

  A few users share personal anecdotes of encountering suspicious packages and emphasize the importance of community reporting and vigilance in identifying and flagging such malicious activity. The ease with which malicious actors can publish packages is contrasted with the difficulty of fully securing the ecosystem, highlighting the ongoing challenge.

  Finally, some comments delve into technical details of the malware's behavior, discussing the obfuscation techniques used and the potential payload delivered. This contributes to a more technical understanding of the threat and how developers can better protect themselves.