55
Shai-Hulud round 2 on GitHub, massive leaks of data and propagation of stealer (about.gitlab.com)
submitted 8 months ago by to c/opensource@lemmy.ml
7 comments fedilink hide all child comments
 

Publication croisée depuis https://programming.dev/post/41331208

"Upon execution, the malware downloads and runs TruffleHog to scan the local machine, stealing sensitive information such as NPM Tokens, AWS/GCP/Azure credentials, and environment variables.

The malicious code exfiltrates the stolen information by creating a GitHub Action runner named SHA1HULUD, and a GitHub repository description Sha1-Hulud: The Second Coming.. This suggests it may be the same attacker behind the "Shai-Hulud" attack observed in September 2025.

And now, over 27,000 GitHub repositories were infected."

Other source with list of compromised package available

all 8 comments

sorted by: hot top controversial new old
[–] 7 points 8 months ago (2 children)

What are the implications for users of FOSS? Should we not be downloading from github?

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
    • [–] 3 points 8 months ago (1 child)

    NPM should be destroyed, at this point… so many problems come from that place.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [+] 11 points 8 months ago* (last edited 2 months ago) (1 child)
    [deleted]
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 8 months ago

    The same can happen for maven, crates, gomods, and other.

    Yes.

    The problem is [intricate dependencies]

    Nah. Dependencies are fine. The method of bringing those in and validating them is where the supply-chain risk accumulates. We knew better when we still had mentors.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 2 points 8 months ago

    I just searched on GitHub for "Sha1-Hulud: The Second Coming.": 692 repositories. On the first page of results I was able to find a repo clearly made by the malware, and in that repo I was able to find someone's github token with a few applications of "decode from base64".

    This is pretty bad. I don't know what exactly comes next, an awareness campaign to get people to clean their infected machines and packages?

  • permalink
  • fedilink
  • source
    •
    [–] 1 point 8 months ago

    It's been a busy day..

  • permalink
  • fedilink
  • source
    •