<story><title>Over 100k Infected Repos Found on GitHub</title><url>https://apiiro.com/blog/malicious-code-campaign-github-repo-confusion-attack/</url></story><parent_chain></parent_chain><comment><author>dspillett</author><text>As well as this being our regular reminder to be careful what you pull from public repositories and other sources, and to verify your dependency trees, it raises another question:&lt;p&gt;If malware is massively prolific in public repos, how much does this affect LLMs and other automation tools that are trained using the contents of such resources? What are the chances that we&amp;#x27;ll see copilot &amp;amp; friends occasionally emit malware in response to coding questions that generate responses long enough for accidentally malicious parts to hide amongst? Simpler vulnerabilities such as simple injection vectors have often been seen already.</text></comment>
<story><title>Over 100k Infected Repos Found on GitHub</title><url>https://apiiro.com/blog/malicious-code-campaign-github-repo-confusion-attack/</url></story><parent_chain></parent_chain><comment><author>keepamovin</author><text>This sucks. Supply chain is such an issue.&lt;p&gt;Even tho we don&amp;#x27;t currently target any npm releases, I make use of socket.dev to monitor my project by creating an npm release for it. But my project BrowserBox (lightweight virtualized web browser) only uses ~800 dependencies including all descendents, with only 19 top-level deps (cool your heels non-JavaScript folks, this is comparatively lightweight for a full stack boing).&lt;p&gt;I&amp;#x27;m considering just snapshotting all 800 deps into a @browserbox namespace at npm. And then tracking any vulnerabilities discovered and patching the fixes.&lt;p&gt;It sounds crazy, but that&amp;#x27;s where we are. At least that way I &amp;quot;own&amp;quot; all the dependencies and can guarantee (up to company security at least) that we don&amp;#x27;t have supply chain vulns on the Node&amp;#x2F;JS side.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;socket.dev&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;socket.dev&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;BrowserBox&amp;#x2F;BrowserBox&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;BrowserBox&amp;#x2F;BrowserBox&lt;/a&gt;</text></comment>