Attackers compromised 42 GitHub repositories by using files too large to be searched

Publisher excerpt From CSO Online

A security research firm reported Monday that it had identified breaches of 42 third-party GitHub repositories in which attackers had deployed payload blobs large enough “to evade the GitHub search and API paths normally used to find this kind of compromise.” The report from JFrog Security Research said the victimized repositories contained execution hooks for AI coding assistants and IDEs, along with polymorphic wrappers as large as 13.7MB that “all decoded to the same hidden CI-publisher payload. The campaign’s attacker-owned repository also operates as an active encrypted data sink, receiving snapshot envelopes, and the attack leveraged a new camouflage: a compiled native addon that contains no payload of its own, and instead decrypts a file named .napi_cache at runtime to reveal the real one.” JFrog said that the investigation also uncovered account hijacks, forged commit timelines, short-lived publishing branches and exposed npm credentials. Shellpanel artifacts in the same hijacked owner cluster link this GitHub victim infrastructure to previously reported GitHub Actions exploitation of internet-facing cPanel systems. “During October 21 our scanners alerted us about shai-hulud packages found in the npm ecosystem,” JFrog wrote. “SafeDep’s October 22 analysis first documented the npm/package side of this activity and decoded event-bus-lite-testmetest@0.0.1. SafeDep described the payload as Miasma-family while explicitly noting uncertainty about its lineage.” SafeDep…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.