Suspicious Star Spikes on Specific Project, Likely Linked to Malicious Bot Activity #180436
-
Select Topic AreaShow & Tell Body
When I checked GitHub this morning, I noticed that my small project (pilgrimlyieu/Focust) suddenly jumped to 123 stars (it only had 1 star before). I immediately felt something was very wrong. I hadn't done any promotion, so why the sudden, massive influx of stars? Furthermore, I noticed that the timing of these stars was highly concentrated. Initially, I clicked on a few accounts, and their activity looked quite normal; it was hard to tell if they were bot-maintained accounts just by looking. But I quickly noticed a pattern: most of them had seven or eight hundred stars, sometimes even over a thousand. Then I randomly checked the star history of several of these accounts and found that they all had starred multiple repositories (including some seemingly random forks) belonging to the user Hrishikesh332 (Hrishikesh Yadav). Later, I dug deeper into the star history of a few more accounts and found that multiple repositories belonging to arpitbbhayani (Arpit Bhayani) were also starred. Earlier on, there were a small number of stars for projects by linus (Linus G Thiel) and torvalds (Linus Torvalds), but I suspect these were just chosen as camouflage due to their fame. Going back further, the projects were more varied. I didn't notice it at first, but quickly realized that many of these repositories primarily used Rust, while others were either TypeScript, Vue, or Svelte. I clicked into a few random ones, and sure enough, they were all developed using Tauri, without exception. This is when I understood why my small, obscure repository was included. I recently uploaded my project to tauri-apps/awesome-tauri: 🚀 Awesome Tauri Apps, Plugins and Resources. When scrolling through the list of projects, I also saw other Awesome Tauri projects listed in the star records of those suspicious accounts. I have already opened a ticket with GitHub Support, although I'm unsure if GitHub will take action. After all, my last support ticket has been open for months without a reply. I am documenting this to see if anyone else has had a similar experience and if there are any effective solutions. Below is the Star History, showing growth at a relatively stable frequency over a short period: Now the count is only 121, as two stars have been removed. I now think it's possible that these accounts are indeed legitimate, but their tokens were leaked and exploited by malicious actors. Therefore, I urge everyone to keep their tokens secure. I have discovered further characteristic some accounts have:
UPDATE: Read Sha1-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposed | Wiz Blog |
Beta Was this translation helpful? Give feedback.
Replies: 4 comments 1 reply
-
|
Similar thing here, my repository (that too is listed on awesome-tauri) gained around a hundred stars in a very short period of time, which seemed very suspicious. |
Beta Was this translation helpful? Give feedback.
-
UPDATEI continued scrolling past this point, and the subsequent items were outside the Tauri ecosystem, though I vaguely remember FastAPI. I'm now trying to see if there are any new characteristics, but it might be difficult here, especially since the "victim" might already have some stars. Based on the user's star list above, the last Tauri project is Kaas, and the first project that is no longer Tauri is piccolo admin. This project's main languages are Python and Vue, so I searched Awesome Python and Awesome Vue, but found nothing. However, I quickly had a flash of inspiration and checked the README. It indeed used FastAPI, so I then searched Awesome FastAPI. Unsurprisingly, it was listed there. But then a new item appeared. The last one that satisfied the pattern was FastAPI with Observability, and the new one was Azure AI-900 Exam Notes / Preparation Repository. I initially couldn't find any specific characteristic for this one, thinking it might have been there originally, but a second item I found also had it. Since I couldn't find any features for this project, I directly copied the name + "Awesome" and searched on GitHub, but found nothing. Removing "Awesome" still didn't lead to any possible "list." So I gave up on that and decided to see what the first "suspicious" project was. However, this might be difficult because the star order is not perfectly consistent. Upon further review, the characteristic of this project might be that the owner is anxkhn (Anas Khan), similar to the first two users, and it includes a few other repositories from this user. Hmm... I wonder if it's a coincidence, but I checked, and these three users seem to be Indian? I saw the word "Mumbai" on the first user's X profile, and this user's location also seems to be in Mumbai? Of course, this is hard to say for sure, as Mumbai is a major city. There's also another repository, ninadnaik10/ninadnaik10, who also seems to be Indian. Their X profile indicates their city is also in Mumbai? Then there's the Linux kernel repository, and after that, there are no more duplicates. It seems this is the starting point? |
Beta Was this translation helpful? Give feedback.
-
|
I can confirm there might also be a link with "Awesome FastAPI" where my open-source project Mailer is listed somehow and yesterday also received a spike of more than a hundred suspicious stars. Been following these investigation thread closely. Still don't understand the goal with adding stars to random repositories, this is not a vector of propagation of Shai Hulud 2.0 (especially given it propagates throught the NPM ecosystem, not Rust Crates not Python PyPI). |
Beta Was this translation helpful? Give feedback.
-
|
Hello everyone following this discussion. Before the victims started unstarring the repositories, I conducted an analysis and statistical breakdown of the attack data relevant to my own project. The code has been open-sourced in pilgrimlyieu/Sha1-Hulud-2-GitHub-Stars-Analysis. According to my research, 86.22% of the projects listed on the Awesome Tauri list were "attacked," and 94.78% of the projects on the Awesome FastAPI list were "attacked". Furthermore, the vast majority of the affected projects were inflated with at least 100 stars. More detailed data and the full investigative report can be found in the aforementioned repository. All victims' GitHub usernames have been encrypted to protect their privacy. |
Beta Was this translation helpful? Give feedback.
-
|
and here i was thinking i got a bunch of stars for doing nothing 😄 thanks for the detailed investigation! |
Beta Was this translation helpful? Give feedback.
Hello everyone following this discussion. Before the victims started unstarring the repositories, I conducted an analysis and statistical breakdown of the attack data relevant to my own project. The code has been open-sourced in pilgrimlyieu/Sha1-Hulud-2-GitHub-Stars-Analysis.
According to my research, 86.22% of the projects listed on the Awesome Tauri list were "attacked," and 94.78% of the projects on the Awesome FastAPI list were "attacked". Furthermore, the vast majority of the affected projects were inflated with at least 100 stars.
More detailed data and the full investigative report can be found in the aforementioned repository. All victims' GitHub usernames have been encrypted to …