GitHub Actions Vulnerable to Typosquatting, Exposing Developers to Hidden Malicious Code
Sep 06, 2024
Software Security / Hacking
Threat actors have long leveraged typosquatting as a means to trick unsuspecting users into visiting malicious websites or downloading booby-trapped software and packages. These attacks typically involve registering domains or packages with names slightly altered from their legitimate counterparts (e.g., goog1e.com vs. google.com). Adversaries targeting open-source repositories across platforms have relied on developers making typing errors to initiate software supply chain attacks through PyPI, npm, Maven Central, NuGet, RubyGems, and Crate. The latest findings from cloud security firm Orca show that even GitHub Actions , a continuous integration and continuous delivery ( CI/CD ) platform, is not immune from the threat. "If developers make a typo in their GitHub action that matches a typosquatter's action, applications could be made to run malicious code without the developer even realizing," security researcher Ofir Yakobi said in a report shared with The Ha...
