Threat actors are manipulating the search functionality on GitHub, the opensource software sharing site, to distribute malware among unsuspecting developers.

“The use of malicious GitHub repositories to distribute malware is an ongoing trend that poses a significant threat to the open-source ecosystem,” Yehuda Gelb, a security researcher at Checkmarx. “By exploiting GitHub’s search functionality and manipulating repository properties, attackers can lure unsuspecting users into downloading and executing malicious code.”

According to Chekmarx, attackers are generating malicious repositories using popular topics and names on GitHub, employing methods like automated updates and fake stars to increase their search rankings, making them more viewable to unsuspecting users.

The malicious code is often hiding deep within Visual Studio project files such as .csproj or .vcxproj to avoid detection.

The code is embedded with a pre-build event of the file, and is set to be automatically executed during the build process.

Malicious scripts such as these contain two parts, a batch script which sets up the environment, and a base64-encoded PowerShell script that is decoded. Both are then executed.

The PowerShell script typically will retrieve the country code of the machine’s IP address, download the content from specific URLs based on the country code, and download encrypted files from each URL, extracting them with a password, and then executing the files.

According the Checkmarx’s coverage, an active GitHub campaign took place on 3 April, where an attacker updated a malicious script within a repository, redirecting to a new URL that downloads an executable file that was padded with zeros to make it too big for many security solutions to detect.

Recommended reading

• UK Gov to Link China to Electoral Commission Cyber-attack
• NCSC Releases Cyber Incident Response Guidance for CEOs
• Over 1 in 10 Business Leaders Don’t Know if They’ve Been Hacked

“The results of our analysis of this malware suggest that the malware contains similarities to the “Keyzetsu clipper” malware, a relatively new addition to the growing list of crypto wallet clippers commonly distributed through pirated software,” Yehuda Gelb wrote for Checkmarx.

The problem appears to be spreading, as Checkmarx recorded several instances of complaints of malicious repositories.

Gelb recommended watching out for red flags when interacting on GitHub, including checking if a repository have an unusual number of commits relative to its age, and if the accounts which gave the repository a star rating were created at the same time as the repository itself.