Major developer platform GitHub faced a widespread malware attack and reported 35,000 “code hits” on a day that saw thousands of Solana-based wallets drained for millions of dollars.
The widespread attack was highlighted by GitHub developer Stephen Lucy, who first reported the incident earlier on Wednesday. The developer came across the issue while reviewing a project he found on a Google search.
I am uncovering what seems to be a massive widespread malware attack on @github.
– Currently over 35k repositories are infected- So far found in projects including: crypto, golang, python, js, bash, docker, k8s- It is added to npm scripts, docker images and install docs pic.twitter.com/rq3CBDw3r9
— Stephen Lacy (@stephenlacy) August 3, 2022
To dupe developers and access critical data, the attacker first creates a fake repository (a repository contains all of the project’s files and each file’s revision history) and pushes clones of legit projects to GitHub. For example, the following two snapshots show this legit crypto miner project and its clone.
Original crypto mining project. Source: GithubCloned crypto mining project. Source: Github
Many of these clone repositories were pushed as “pull requests,” which let developers tell others about changes they have pushed to a branch in a repository on GitHub.
Once the developer falls prey to the malware attack, the entire environment variable (ENV) of the script, application or laptop (Electron apps) is sent to the attacker’s server. The ENV includes security keys, Amazon Web Services access keys, crypto keys and much more.
The developer has reported the issue to GitHub and advised developers to GPG-sign their revisions made to the repository. GPG keys add an extra layer of security to GitHub accounts and software projects by providing a way of verifying all revisions come from a trusted source.