Cannot Depend on Dependabot: Found Contributing Malicious Code

Diving into Details

• Threat actors meticulously fabricated commit messages to mimic Dependabot's automated contributions to mask the malevolent activities they were indulging in.
• This stealth approach was shockingly effective, as most developers trust Dependabot's commits without scrutiny. The perpetrators misappropriated victims’ GitHub accounts to make these malicious code contributions. 
• These codes were crafted to divert the GitHub project's secrets to an attacker-controlled C2 server. Additionally, JavaScript files within the targeted project were tampered with, embedding them with a password-stealer malware, which posed a direct threat to end-users.

Modus Operandi

• Between July 8 and July 11, an unidentified threat actor began compromising a multitude of GitHub repositories, affecting both public and private sectors, with a significant number of victims originating from Indonesia. 
• The attackers skillfully manipulated commit messages, leading developers to believe that the real Dependabot had made these contributions. 
• On delving deeper into these repositories, certain consistent patterns emerged. 
• A new GitHub Action file titled “hook.yml” was recurrently noticed. This new file, upon every push event, would send GitHub secrets to a specific malicious URL. Furthermore, all existing “*.js” project files were appended with an obfuscated line, posing additional threats.

Conclusion