Threat actors are exploiting GitHub’s search feature to trick users into downloading malware-laden repositories disguised as popular projects. Checkmarx reveals the infiltration of malicious code within Microsoft Visual Code project files, aiming to fetch additional payloads from remote URLs. By manipulating search rankings and leveraging fake stars, attackers create an illusion of legitimacy, enticing unsuspecting developers to unwittingly install malicious software.
The devious tactics extend beyond mere manipulation of search results; attackers employ subtle strategies to evade suspicion, opting for a modest number of fake stars to avoid detection. Furthermore, recent findings expose a black market trend where GitHub stars are sold to inflate repository popularity artificially. Malicious repositories often masquerade as legitimate software related to popular games and tools, adding layers of complexity to their camouflage.
Some repositories have been observed distributing large encrypted files containing executable malware, such as the notorious Keyzetsu clipper. This malware, reminiscent of previous threats like Evernote-related attacks, intercepts cryptocurrency transactions by substituting wallet addresses in the clipboard. These developments underscore the importance of due diligence for developers when sourcing code from open-source repositories and the perils of relying solely on reputation metrics for assessing trustworthiness.
In parallel, another concerning trend emerges with spam packages infiltrating npm registry, orchestrated by a user named ylmin. Exploiting the Tea protocol, these packages aim to amass points from an incentivized testnet, anticipating future rewards. Despite the protocol’s goal of compensating open-source maintainers, nefarious actors misuse it for crypto farming, posing yet another challenge to the integrity of the open-source ecosystem.
