PR sneaking
Demonstrates methods for sneaking malicious code into GitHub pull requests to raise awareness of supply chain vulnerabilities.
Overview
A repository demonstrating how you can sneak malicious code into Github PRs
Related Projects
Unpinnable Actions: How Malicious Code Can Sneak into Your GitHub Actions WorkflowsGitHub Actions, even when pinned to a commit SHA, can still pull in malicious code via mutable dependencies like Docker images, unlocked packages, or external scripts
Why npm lockfiles can be a security blindspot for injecting malicious modulesMalicious code can be injected into npm projects via lockfiles (package-lock.json or yarn.lock) because these large, machine-generated files are rarely reviewed thoroughly
Remove evidence of malicious pull requests on GitHubChanging account's email to block-listed domain, automatically bans the account
GitHub comments abused to push malware via Microsoft repo URLsHidden GitHub comment link
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.