On a day when thousands of wallets with Solana addresses had millions of dollars' worth of funds stolen, the important developer platform GitHub came under a pervasive malware attack and reported 35,000 "code hits."
Stephen Lucy, a GitHub developer who originally reported the event earlier on August 3, brought attention to the attack's broad reach. The problem was discovered by the developer as he was looking at a project that he had located via Google.
The assault has so far been discovered to have damaged a number of projects from the crypto, Golang, Python, JavaScript, Bash, Docker, and Kubernetes communities. The docker images, install documentation, and npm script—a practical approach to group frequent shell operations for a project—are the targets of the malware attack.
The attacker first makes a fake repository (a repository holds all of the project's files and each file's revision history) and pushes clones of legitimate projects to GitHub in order to trick developers and gain access to crucial data. The following two screenshots, for instance, display this legitimate crypto miner project and its clone.
These "pull requests" were often used to push these clone repositories. Developers can inform other users of changes they have published to a branch in a GitHub repository using pull requests.
The whole environment variable (ENV) of the script, application, or laptop (electron apps) is communicated to the attacker's server as soon as the developer succumbs to the malware attack. AWS access keys, crypto keys, security keys, and other things are all part of ENV.
The developer has opened a GitHub issue and recommended other developers to GPG sign their repository revisions. Your GitHub accounts and software projects are more secure thanks to GPG keys because they give you a way to confirm that all revisions come from a reliable source.