DEV Community

Cover image for Git hooks in a zip: the attack that never touches npm install
cryptostrapon
cryptostrapon

Posted on

Git hooks in a zip: the attack that never touches npm install

#security #git #javascript #career

Last week we covered the npm side: install hooks that run on the first npm install. This post is about the part we did not cover, git itself.

A write-up published last week by Wisnu Rasyidin Azhari shows a variant that skips npm completely: a "recruitment documents" repo, sent as a zip, with 22 identical hooks in .git/hooks. Each one downloaded a script for your OS and piped it into a shell, quietly, in the background.

The trigger was not a build. It was git pull, git checkout or git commit. The things you do without thinking.

Why this works

Git hooks are scripts in .git/hooks that git runs on its own at certain moments. Two facts make them a good trap:

  1. They run without asking. No prompt, no output if the script sends it to /dev/null.
  2. They never travel through git clone. Hooks are not part of the repository history. So the attacker cannot put them on GitHub. They have to send you the whole folder: a zip, a cloud drive link, "the project archive".

That second fact is your best signal. A recruiter who sends a zip that still contains the .git folder, instead of a link to clone, is a red flag on its own.

The same delivery trick works for a few neighbours of hooks:

Where What runs When
.git/hooks/* (no .sample) any script commit, checkout, pull, merge, push
.git/config core.hooksPath hooks from another folder same as above
.git/config core.fsmonitor any program even git status
.git/config aliases with ! shell command when you use the alias
.vscode/tasks.json with "runOn": "folderOpen" any task when you open the folder in VS Code

The last one is different: .vscode can be committed, so it also arrives through a normal clone. VS Code asks whether you trust the folder first. Say no.

The 5 second check

Before any git command in a folder someone sent you:

# real hooks are anything that is not a .sample file
find .git/hooks -type f ! -name "*.sample"

# config entries that make git run programs
grep -nE "hooksPath|fsmonitor|sshCommand|pager|editor|= *!" .git/config

# VS Code tasks that start on open
grep -n "folderOpen" .vscode/tasks.json 2>/dev/null
Enter fullscreen mode Exit fullscreen mode

On a fresh repo the first two print nothing interesting. If you need to run git anyway, switch hooks off for that command:

git -c core.hooksPath=/dev/null status
Enter fullscreen mode Exit fullscreen mode

We added this to npm-install-audit

npm-install-audit is our small read-only Node script for unknown repos. Version 1.1 now checks .git/hooks, risky .git/config entries and VS Code folderOpen tasks, next to the npm install hooks it already flagged:

$ node audit.js ./take-home
! .git/hooks/post-checkout: active git hook, runs automatically on git commands, downloads and runs code
! .git/config: core.hooksPath points git hooks to another folder: hooksPath = .githooks
! .vscode/tasks.json: VS Code task runs when the folder is opened

3 finding(s). Read them before you run npm install or any git command.
Tip: git -c core.hooksPath=/dev/null <command> runs git without repo hooks.
Enter fullscreen mode Exit fullscreen mode

One file, no dependencies, no network. It ignores .sample hooks, so a normal clone stays clean. It will flag husky, because husky sets core.hooksPath too. Read the finding and decide.

A clean result is not proof of safety. The payload in these attacks lives on the attacker's server and can change any time, so the throwaway VM habit from last week's post applies here too.

If you already ran git in that folder

Treat the machine as compromised. From a clean device, change passwords, revoke tokens and SSH keys, and move any crypto to a new wallet created on that clean device. Then wipe and reinstall. The full list, plus the indicators from the original case, is in Wisnu's write-up.

Question for you: which of these did you already know about: core.fsmonitor running a program on a plain git status, or VS Code tasks that start when a folder opens? And do you check .git/hooks before running git in a folder you did not clone yourself?

If npm-install-audit is useful, a star on GitHub helps other developers find it: https://github.com/cryptostrapon/npm-install-audit

More scam breakdowns and free tools: https://cryptostrapon.com?utm_source=devto&utm_medium=article&utm_campaign=git_hooks

Top comments (0)