Skip to content

Cooldown or compromise the three-day rule for npm and PyPI #508

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
carlospolop wants to merge 1 commit into from
Closed

Cooldown or compromise the three-day rule for npm and PyPI #508

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/pentesting-ci-cd/github-security/abusing-github-actions/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -736,6 +736,10 @@ import base64,os;exec(base64.b64decode(os.environ["STAGE2_B64"]))

Drop the line above into a file such as `evil.pth` inside `site-packages` and it will execute during Python startup. This is especially useful in build agents that continuously spawn Python tooling (`pip`, linters, test runners, release scripts).<sup>[[25]](#references)</sup>

A poisoned wheel can preserve normal package behavior while adding a launcher to its `__init__.py`. The launcher runs when the package is imported, not merely when the wheel is installed; the compromised Lightning wheel used a hidden `_runtime` directory for this path.<sup>[[49]](#references)</sup>

A wheels-only policy excludes source builds, but it does not block import-time code or `.pth` startup hooks shipped in wheels.<sup>[[50]](#references)</sup>

#### npm supply-chain pivots from GitHub Actions

For `binding.gyp` / Phantom Gyp execution, wormable npm publishing with stolen CI identities, and the limits of trusted publishing provenance after workflow compromise, check:
Expand Down Expand Up @@ -997,4 +1001,6 @@ An organization in GitHub is very proactive in reporting accounts to GitHub. All
- [46] [actions/toolkit core package - GitHub](https://github.com/actions/toolkit/tree/main/packages/core#setting-a-secret)
- [47] [actions/checkout v5 action manifest](https://github.com/actions/checkout/blob/e8d4307400f9427dba7cb98e488d6ab85f1cec5f/action.yml#L118)
- [48] [Compromised AsyncAPI npm Packages: Inside a CI Supply-Chain Attack](https://securitylabs.datadoghq.com/articles/compromised-asyncapi-npm-packages/)
- [49] [Lightning PyPI compromise: Bun-based credential stealer - Snyk](https://snyk.io/blog/lightning-pypi-compromise-bun-based-credential-stealer/)
- [50] [Cooldown or compromise: the three-day rule for npm and PyPI - Eye Research](https://research.eye.security/cooldown-or-compromise-the-three-day-rule-for-npm-and-pypi/)
{{#include ../../../banners/hacktricks-training.md}}
Loading