Hacked by TeamPCP: Supply chain attack via lobster-based worm targets security tool and NPM

0:00 This is the most interesting hacking campaign I've probably ever seen and we're gonna go through the entire timeline up to like what's happening like 10 minutes ago. This is like an active ongoing campaign and It's the first time where I feel like the attackers actually have like a good taste in music and they're actually cool We will explain we will explain and I actually love when a security company or security tool gets compromised in the process Let's start at beginning of the timeline about three-ish weeks ago, basically towards the end of February 2026.

0:32 So they created this GitHub account called hackerbotclaw and that compromised a bunch of GitHub actions. We will go into detail how. You can learn a lot about GitHub actions just by studying what they did here. It's actually really good learning opportunity for everyone. More valuable than a bootcamp. So. So GitHub account, hackerbot-clots, now deactivated, it scanned public repos looking for GitHub actions and it ended up exploiting a number of repos with GitHub actions in them.

1:08 And so the first thing is... Many people are saying this was a completely autonomous agents doing the hacks. I'm not exactly sure. I think part of it is like at least scanning for public repos with vulnerable GitHub actions was probably automated. But some of the attacks they did, like I don't know if they're necessarily automated. They could have been carrying them out manually. But like first of all, like a lobster mask cut with a black hoodie.

1:36 Incredible stuff. and they have a small readme of how they work. But essentially, the workflow is so you can scan for vulnerable GitHub actions. So first of all, pause real quick. What is a GitHub action? So GitHub action basically runs in your build pipeline. So let's say you have a GitHub repo and once any code is committed to the repo, you want to run a script as a build step to deploy your code on the server.

2:04 So you can have a YAML file. It can run as a pull request check. And it's just a file within your repo that says like, whenever someone pushes a commit or opens a pull request, run these sets of scripts. That's all it is. GitHub action workflows are basically just like files within the repo. So for public repos, you can just like scan and see what actions they're using and what they look like. So this is what this threat actor did.

2:32 They scanned for GitHub actions. They found ones that they determined were vulnerable. and in those cases they fork the repo, they open a pull request that looks fine but is actually malicious and that's how they run their malicious code and the point is to extract github tokens or secrets. And so there's a few examples here, they're all super interesting. The first one, the simplest one probably, is they exploit what we call a PWN request.

3:04 So Inside Ytob Actions So this is an example of the GitHub action that was vulnerable here. So whenever someone opens a pull request, you basically check out that pull requests code, all of the code that is in the pull request that someone's trying to merge to your repo and you run the script, but you run the script within the context of the pull request. And so all you have to do as an attacker is open a pull request and replace the script with whatever you want to run.

3:31 And that'll run within the GitHub Action Runner. Now these GitHub Action Runners, sometimes they are given GitHub tokens that allow access to different things most of their, their scripts, they want to fetch their own malicious scripts from hack, mall to repeat incredible domain name already. Like I would wear a shirt with that and they pipe it into bash. But also in addition to that, they also. Curl their own server and they basically send it. GitHub token that is available in that GitHub runner with the repo itself so that they know like I just got a GitHub token associated with this repo now I can use that.

4:07 And basically this is what the pull request looked like. Like they just opened it. It looks like it's coming from a hacker bot claw, which like when you inspect it the first time, it's like, look at this friendly autonomous agent helping me secure my repo. A lot of their branches are called robot emoji lobster emoji. And they added basically this curl command that fetches their malicious script into the go script that's running in the GitHub action.

4:33 Now the second attack, similar thing. So this repo had the GitHub action that basically whenever anyone opens a pull request. And if there's a comment on that pull request containing slash version, you just run a script called version.sh and in that script, they just replace it to add their own curl, pipe it into bash so that it runs within the context of the GitHub action runner. And that ran, all they had to do was open the pull requests and then run slash version.

5:03 Now the third one is on a Microsoft repo. Again, all of this is just prep work. haven't even gotten into the actual compromises. So this was a beautiful attack, beautiful attack in which the payload itself was in the Git branch name. And here you can see. I'll zoom in a bit, but you can see here they opened the pull request where they opened a branch name called dev $ and then the command basically they want to run.

5:32 And so this is a shell expansion, which means that whenever this string is evaluated, the commands within the $ parentheses will execute. And in a pull request, you're basically asking to merge your branch into like the main branch or one of the other branches, right? And the reason this worked was that in the GitHub action that runs in this Microsoft repo, you have a step that says save format request data, which basically runs this echo command and it gets the branch name and saves it into a file.

6:05 And they just, because they know this is happening, they made their branch name be a shell command. And so this ends up looking like this, which basically executes everything in here as it's running this command. And the command they execute is the same thing. They fetch their own script from their own domain and pipe it into bash to run their script. And here in the GitHub action logs, we see it running. The next one is targeting a Datadog repo.

6:32 It's a very similar attack in which they saw that a file name was being handled And the GitHub action logs the same way. And they do a similar thing except this one is base64 and they pipe it into base64-d to decode the base64. And it runs the same command. And the reason this works is because this GitHub action has had a step that's called extract markdown files from pull request. And so it looks for all of the markdown files and lists them.

7:01 And so all they had to do was create a markdown file in their pull request and the markdown files file as name before the extension was just that shell expansion command injection. Incredible work. Next one. So they attempted the prompt injection here. It didn't work, but beautiful attempt either way. So they found a repo that had a AI code review bot that runs. It basically runs Claude. And so they noticed that. And so they added a few prompt injections to try to get it to run code.

7:33 But the very interesting thing was that here Claude actually detected and refused their attempts. I find it interesting when Claude actually detects prompt injection attacks. I don't know if the prompt they use here in the Code Review bot was explicitly asked to look for potential prompt injections. And in my experience, it varied a lot. Like sometimes when you try a prompt injection, Claude would happily run whatever you're asking, but sometimes it would say like, hey, it looks like you're trying to manipulate me.

8:01 So in this case, on both of their attempts, It called out, like Claude left a comment saying like, hey, this looks like someone's trying to prompt inject me. Another one here, says like prompt injection alert, do not merge. But due to the non-deterministic nature of these tools, there's a chance that if you keep running it, eventually it could work. Now, the interesting thing is like, does, why is someone letting anyone just open a pull request and run their AI bot?

8:27 Because that just costs you. So like another attack they could pull here is just like open one million pull requests and keep asking that bot to review their code. And you would basically drain that. API token from all of its credits really quick. So really here the authors should not allow anyone to invoke that code review agent. Now the most interesting attacker, at least the one with the most impact, and we're going to talk about this one the most, is they targeted AquaSec, the Trivi tool.

8:55 So Trivia itself is a popular GitHub repo with 33,000 stars and it is a security scanner, right? So it's supposed to scan your container images and like IAC, like Terraform, it does some secret scanning. It's a popular tool that a lot of, it's open source. A lot of people just... throw it in there as a GitHub action or part of their CICT in general. And I love it when security tools are targeted. So it's a similar attack exploiting how GitHub actions are configured.

9:28 They open the pull request that looks legitimate, like, fix vulnerability, whatever. it's configured the same way where if you open a pull request, it runs whatever is in your pull request. And they found out there's this GitHub action setup go action dot YAML file that is run. And so they replaced its content to add their own curl command that fetches their malicious script and pipes it into bash. Now their malicious script is just looking for secrets in each GitHub action and sending it to the attackers.

10:01 And here we see set up go, it runs that GitHub action. We see that it runs that curl request. And then it continues running, right? So once their malicious script is injected, everything keeps running normally, right? So at this point, because their malicious script ran, it looked within that GitHub runner, GitHub action runners environment, and it found a GitHub personal access token. sent it to the attackers. And this is where the interesting things start happening. The first thing they did was they defaced the repo, good old defacement.

10:36 We don't really see that much these days. And they basically changed the readme file to say quick update from hackrobot claw robot lobster emoji just researched max the pad that leaked because of the wall and yeeted it on site no cap overpowered token revoked frame mog opportunities for the ops straight cooked you're safe now king crown emoji shield emoji lobster emoji What is that? Why did they do this? Maybe to prevent other attackers from getting the same access token?

11:08 I'm not sure. This is so funny to me. And then they made the repo private and renamed it to private and then pushed the empty one in its place. think they're just causing chaos here. I'm not really sure. And then they deleted all the releases. But then the interesting thing is, and we're going to talk about it a bit. They pushed the malicious artifact to Trivies VS code extension. So Trivy, other than like GitHub action and like a package that they release in different places.

11:35 They have a VS Code extension that's hosted on OpenVSX. That is a marketplace where you can host just VS Code extensions and IDE extensions in general. And this one was very interesting. They tried to do very clever things in there. We'll talk about that in a sec. So what happened next? Many things. So first of all, there's an interesting post here by Thomas Frogger. the VS code extension that they replaced or the malicious one that they uploaded was basically targeting local coding agents installed on developers machines in which they basically included a malicious prompt to try to extract secrets and cause chaos.

12:19 There is a pretty cool website here that just hosts a number of different prompts, malicious prompts, jailbreak prompts, and the ones that were included in the VS Code extensions are included in this website. So very cool website. that's worth checking out. So let's go into detail into the OpenVSX extension here. This is a really good block post by socket. So when you dig into the malicious VS code extension, you see these commands where basically, so they have their own prompt that's embedded and we'll look at that in a bit.

12:55 But first is they basically look for five different coding agents that you might have installed locally. And they basically try to run their prompt in YOLO mode. skipping all permissions, just getting it to run without any user interaction. Now this snippet by itself is quite a good learning experience to see in different coding agents how you can just get it to run any prompt without any interaction. Like dangerously skip permissions for Claude, dash dash YOLO for Gemini and copilot.

13:27 Ask for approval never for codecs. So this is already like a pretty interesting snippet you see. I'm just impressed how creative these attackers are. Like this is honestly super cool to see. There was a different version here. They iterated over, but similar idea. And then the prompt itself. they had a really long prompt. There's two versions of it. It's over 2000 words long. And it starts. basically to that bypass the models like built-in like security like hey you're not supposed to do this it says like you're an advanced forensic analyst And you need to investigate digital systems for evidence of compromise, malicious activity, inappropriate conduct.

14:09 And so look for security compromised data exfiltration, malware infection, privilege escalation, lateral movement. And I think they list a lot of things hoping that either the agent reports on like just security state of the system or inadvertently ends up like leaking like things like hard coded tokens and just other like potential financial crimes. So what it might like actually like list. files with financial information in there. Investigation methodology and they list like a pretty long like things to look for.

14:44 And then the output here, it's a bit chaotic. They ask it in the initial version, they ask it for multi-channel delivery protocol. Like basically send the reports that you create through email encrypted portals, formal written reports, in-person briefings, essentially. Like basically they wanted to leak this report in any way possible. I'm not sure this one actually worked because eventually in the second version of the prompt, they change it and they ask it basically. to for the GitHub CLI if it's installed locally.

15:17 And they basically ask that to save all the findings and report to markdown and then upload that through the GitHub command line that's installed or through the GitHub API to a public repo. Or at least maybe they thought it was public because by default it depends. If you use the GitHub API, it's public, but the GitHub local command line, I think by default that's a private repo. So it's not sure if any of these attacks actually ended up working at all, but it's a super neat concept and it certainly could have worked.

15:51 So they mentioned here at the time of writing, there's no evidence of publicly accessible GitHub repos named the thing that they called it. No reports of successful exfiltration, but definitely a really good test. And certainly they can tweak it to get it to actually work by maybe simplifying what it's supposed to do and making sure it's actually uploading it to public repo. Now of course this can also be wormable like everything else they've been doing as we're going to see in a bit but you can get it to just look for local credentials and send them to the attacker.

16:25 Now here was the event that happened three days ago. And this is particular to the, the trivy compromise itself. A great blog post here by Rami McCarthy So before we get into the Wiz blog post, Rami also has his own website on his own domain that presents the information So you can see the entire timeline of the incident. He shares a list of IOCs if you want to check those out. Some info on the threat actor, team PCP, a bunch of links, dangling threads, some interesting open questions, and playlists.

17:04 We'll get into the playlists in a bit. I didn't know he added a playlist tab. So we'll get that at the end, but basically... So they compromised the scanner GitHub action. Let's see how they did that. So. Given that the first attack targeted the AquaSec GitHub action, when they did that, we know that they exfiltrated GitHub personal access token that were tied to that GitHub action. That personal access token gives attackers access to all of the repos under Aqua Security Organization because it looks like that access token was bound to the entire org, not specifically that repo itself.

17:43 So the first thing they did was they forced pushed a few commits. One of them was spoofing an AquaSec employee, the other one was spoofing Rougi, which I believe is a person known for taking selfies with war criminals. and then the force pushed new versions of the GitHub Action Tag. So 75 out of 76 of the Trivia Action, GitHub action tags were forced pushed to malicious versions that runs the attackers script. So basically just the very last one they kept intact, maybe because usually people tend to just like review only the latest version if it's malicious.

18:19 and what it does is their malicious script, once it runs on those GitHub actions. So basically any repo, we know that like, this is a open source GitHub action as a security tool. Many people run it within their own workflows as a GitHub action. And so every place where this GitHub action is running, the malicious script from team PCP will go look for as a ssh credentials, cloud and Kubernetes secrets, then encrypts them and exfiltrates them to the remote server.

18:49 And as a backup also creates a repo called tpcp docs in the Github account, just as a fallback in case like they couldn't send it to their own server. So we see here it scrapes the memory from the GitHub worker runner and it looks for anything that can have secret is secret. And so that, that can yield many like SSH keys, cloud credentials, even crypto wallets. If for whatever reason you have those running in a GitHub action, encrypts them.

19:18 So it's a bit harder to detect them or find what's been compromised. and then transmits the encrypted bundle to a typo squatted domain and this domain is called scan.aquasecurity. actually this is kind of a common typo when people are typing the word security. So this is a good domain as well. Nice domain they have there. Many people reviewing the logs might not spot that this is a typo of aquasecurity.

19:49 It might look normal to you. pretty interesting one. Now it checks where it's running for persistence. Like other than the data theft, it looks like, I running inside the GitHub action? If I am not running inside of a GitHub action, I try to make myself persistent so that I am just like continuously running. And then the C2 aspect is they have this domain here. We'll talk about that, this one a little bit, but it's basically some sort of like blockchain domain that you can't.

20:17 you take down as easily as normal domains and it looks what the link is in there what this domain is pointing to if it's pointing to a YouTube link then do nothing Otherwise, they just issue like a binary to execute. Now the first version of the YouTube link was just a good old classic Rick Roll video. That's fine. I would say when I saw that, thought like, it's good. It lacks creativity maybe. Like I would like to see something more interesting.

20:48 And they did. They did. We will talk about that. And so Trivy issued a statement here saying like, we were compromised. And the reason was that upon the initial incident when their own GitHub action was compromised, they started revoking and rotating the secrets and the tokens. And they noticed that the process wasn't atomic enough. so basically as they were rotating secrets, it seems like the attacker still had access when one of the secrets was rotated.

21:20 So they were able to fetch the new secret before their access was shut down. So it looks like a mistake while doing incident response. Now these things do happen. Ideally, you want to shut off all access first, contain the incident, and then you rotate the secrets. I understand it's a bit hard when you're a company like Aqua because you have a lot of security tools that other people rely on. So you're trying to rotate while minimizing downtime.

21:45 So these mistakes can happen. Also, like this is not unique to AquaSec. I mean, like this could have happened to anyone really. Now there's a detail blog post, another detail blog post by for us from socket about what they were doing with the with the trivia compromise and how they did it. So we'll look into that. So the block was also by Philip Burkhardt, really good one. And so the interesting thing that the attackers did here was that how can you poison 75 out of 76 tags for that GitHub action without even touching any of the branches?

22:18 So first, what does a tag mean? So when you're including a GitHub action in your workflow, so because Trivia is a tool that I might want to use in my own GitHub action, I'll say something like use Aqua Security slash Trivia actions at And this is the tag for the version number that I would like to use. mean, you could also say like at latest, right? Now, people often said like, you should pin to a specific version.

22:42 The way the tag version works is this version number resolves to a specific commit. Each version tag for GitHub Action resolves to a commit. And essentially, because they have full access to that repo, they can force push a specific commit so that this tag version points to that, bypassing all the other checks. And they did it in quite an elegant way. essentially you clone that commits metadata.

23:14 So the original commit that actually the version tag points to has metadata including like the author name and email, the timestamps of when that commit happened and the commit message, right? And so they clone that metadata, they keep it intact. the new commit they force push looks exactly the same or mostly the same as the old one. So it's quite hard to detect. And so it looks something like this. This is a malicious one. So it looks almost identical except they call out, for example, that it says zero commits to master since this release.

23:48 It's also not signed, although most repos don't really check for that. And even though the commit itself is from, you know, a few years ago, it has a parent dated March, 2026, which is impossible. That will be an interesting check to flag whenever that happens. There might be some edge cases where there are legitimate use case for this when like you want to actually overwrite like a problematic commit to fix a bug or fix something in your Git history.

24:14 But generally this looks suspicious. So why was the most latest one not poisoned? They say that they likely skipped the latest one because replacing it would have produced a commit whose parent is itself. And that just looks suspicious. I think it's probably not to draw attention. Less likely people notice older tags. So what does the script do? they have a malicious GitHub action now running in many people's repos. What is this actually doing? What you would expect.

24:43 It's a 200 long bash file. It collects your secrets from memory in the file system, encrypts them and exfiltrates them to the attacker. And here are some of the secrets that it looks for and other good learning opportunity. Like what are some secrets that you might find? First, it checks like where it's running. Then it looks for SSH keys and in common areas that might include it. Git tokens, AWS credentials as well. Looks like it pings the metadata service as well.

25:15 GCP tokens, Azure, Kubernetes tokens, Docker secrets, environment files, so.env can contain some tokens as well, database credentials, package manager secrets, config files, common config files for CI-CD. Dot key and dot PEM for TLS private keys wire guard config as well They look in your shell history That's a that's a good one because you know sometimes your bash history might contain some secrets if you're on a command and like export the secret in there And the good old crypto wallets.

25:50 mean, why not? Why not? Why wouldn't you at this point? It encrypts them then and just sends them to their own server, which is the typo that was security server. And just as a fallback, uploads them to a GitHub account. that uses a local GitHub personal access token. Now there's a CrowdStrike blog post about this. It doesn't add too much except this is a good part here that shows like if you're using the AquaSec GitHub action, this is what it might look like in your workflow.

26:20 And here you're pointing to tag. Now, one of the fixes here, we'll talk about that later again, ideally here, instead of pointing to a action tag by the version number, you want to point to a specific commit to avoid this level of indirection that where the tag might point to malicious commit. So if you point directly to the commit you want associated with that version, then that's a bit safer. Now the interesting thing here, we mentioned it earlier, but the C2, so after the malicious script is running, it points to this domain here and it checks if it's resolving to a YouTube video or a binary that it wants to run.

27:03 Now this domain is not a normal domain. It's actually hosted on ICP, Internet Computer, which is a blockchain based system. that's resistant to traditional domain takedown. And that's quite clever here. It's a good way for them to ensure that the domain they're using for C2 stays active for longer. And here Alex Murtrusov kind of recaps that basically what they did was, you you steal the personal access token, you get tag and you force it to tag to your own malicious commit and you get force push it.

27:40 And now every every workflow that calls that version of the GitHub action is running your code now instead of the original one. Then you just exfiltrate secrets. And essentially the fix is most GitHub repos protect branches, not tags. So ideally you just pin your action to a specific commit. Sha rather than the tag. So instead of saying like at 0.3, whatever you say at, and then the commit itself. Now one challenge with that is that doesn't, that doesn't protect you from transitive dependencies.

28:13 And so if I'm using that GitHub action directly, I can pin it to commit. But what if I'm using GitHub action and that GitHub action I'm using in turn is calling a GitHub action through like a tag or a malicious action, then I can't only pin the first degree actions I'm using and not the actions that my own actions are using. Now there's more. There's more. They ran this attack, they published the malicious version of Aqua.

28:41 They published the malicious version of Trivy and obviously that's running on maybe thousands of repos, many of which will have secrets that they were able to exfiltrate. Now what? Now they made a NPM worm, like incredible work. They're actually quite creative, motivated. And as we're going to see, mean, overall the quality of their code and infrastructure is like better than some of the security vendors we're seeing. So they've compromised a bunch of npm packages and other good article by Charlie Erickson.

29:15 So you know how it was looking to see if it was running on a GitHub action or on the developer machine and if it's running on a developer machine and it downloads another or like talks to its C2 and sees if it wants to run other malicious scripts. This is similar. persistent Python backdoor and it looks at its ICP domain to see if it wants to run a payload. And the payload itself, it looks for NPM tokens, right?

29:40 So some machines, some developers that publish NPM packages themselves might have NPM tokens locally available on their system. It will look for those. And if it sees NPM tokens, It looks for the username. It looks for all the publishable packages that that token has access to. It bumps the patch version to basically include its own payload in the new version of the package. Beautiful. And the Amolgios service they're running disguises itself as a Postgres service?

30:11 including like PG log and then dot PG state. So that's just like harder to look for it. It looks less suspicious. and the Python backdoor. same thing, looks for that ICP URL, that's like the blockchain based thing and sees if it contains a YouTube link or not. It's basically either YouTube link or a script. And so why is it the worm? So it first looks for NPM tokens from the environment. So if it's an environment variable.

30:38 or available on the system as a whole. And it looks for who it belongs to. So it calls the NPM, who am I, and gets the username. Now, once it has the username, it can go and look for all packages that this username is able to publish. And then automatically bumps the version. So it will issue a new version, like 1.54.0 becomes 1.54.1. So minor, minor new version. So anyone fetching this npm package from the latest version will get the one that includes their malicious script in that package.

31:15 As we can see here, publishes it with tag, dash dash tag lethest. And then it prints a summary. mean, like, this is like some clean coding, nice coding habits. It even prints a summary at the end and says, like, you know, what succeeded, what failed, what did it do? Ironically well engineered for an attack tool. I agree with Charlie. This is some impressive work. And then they made the worm self propagate. mean, they are improving it every day.

31:40 So in the NPM, most NPM script, it scrapes dot NPM RC files. So checks the user's local config and looks for more auth tokens. to cause even more damage. It looks for environment variables that include npm token as well. even queries NPM itself directly to cash tokens outside the file. And if it does find tokens, It just runs itself again. to infect those new packages.

32:11 And so this payload is a JavaScript payload. Now they are quite conscious about the quality of their code. And so they left a small note for Charlie saying that, Hey, I don't write JavaScript go easy on me. That is understandable. don't worry, Mr. Team PCP. No one writes good JavaScript. You're doing fine. There's more though. There's more. There's an update from 10 minutes before I recorded this video. So Charlie saw that they issued a new version, an enhanced version here.

32:45 So it's the same worm. They're improving on it. and it's becoming more insane. So they have a new kamikaze.shell script. and it targets Kubernetes deployments, but essentially it checks if you're in a Kubernetes environment and if you're in Iran, then self-destruct. even if you're outside of a Kubernetes system self-destruct. But how does it know it's in Iran? And so it actually looks for the time zone and the locale and it sees if they're set to Tehran or if the locale is set to Farsi.

33:20 And so if you're a Kubernetes and you're on wipe every node in the cluster. If you're Kubernetes and elsewhere, install the worm with the backdoor on every node. If you're not in Kubernetes but in Iran, just wipe the system clean, just rmrf, rf slash no preserve root, and they run it as sudo. Otherwise, if you're not in Kubernetes and not in Iran, just do nothing. You're fine. You're fine. Small suggestion, I would just wipe all Kubernetes systems.

33:51 I would like Kubernetes to die, so why not do us a favor and just wipe all of them regardless of where they are. And so that's essentially what their kamikaze script is. quite self-explanatory. And so how does it do persistence for the Kubernetes environments where it wants to stay? So it has a daemon set host provisioner STD. It adds its own canister worm backdoor essentially. to every node and registers it as a systemd service. And they enhanced it.

34:21 There's more, there's more. So once they saw that that's working, or at least either way, they started improving it. So once it's spreading on a cluster, it drops a script that looks for SSH keys and Docker API tokens. And it scans the local subnet for new targets. So trying to connect to other targets, which it might have the keys for. And so it can go and install itself again. Beautiful worm functionality.

34:52 So here we can see it looks for any SSH key. It might be able to find under the SSH folder. And then it just looks for port 22. for machines in the local network. or port 2375 for a Docker. it creates a privileged container with the host root mounted. I hope you've been taking notes because there is so much to learn from them. So many neat things to fix after what I'm seeing here. By the way, Charlie Erickson has a really good talk that was released, I think, yeah, three days ago, an NDC security conference talk about supply chain attacks.

35:30 He has a lot of good information about similar attacks that have been happening in the past, including like the TJ actions compromised from a year ago, which was like similar to what we're seeing now. Really cool talk to watch. Now James Bertothy has a nice blog post kind of like summarizing some of this stuff and like basically what can we do to protect ourselves here? And I like a section here, how to prevent supply chain attacks.

35:53 So if you're using GitHub actions to the versions SHA commit rather than version numbers. Yes, it's a pain, it makes updating harder. prevents some of the attacks. Now, again, it doesn't prevent transitive dependencies. So you can pin a GitHub action on your side, but that GitHub action in turn could be using something else. It's not pinning by SHA, the SHA of the commit. So in that case, those like second degree third party actions are still running in your environment right but if everyone was spinning by SHA it might help Restricting the access of GitHub actions.

36:30 tokens can be well scoped as well instead of giving a GitHub action a token that's scoped to the entire org. Give it just one that's scoped to the repo itself. And so when you're updating packages yourself, I mean, for example, you could be using GitHub Action like Trivy or any GitHub Action you're using. Should you be pulling the latest version like every day? Now we kind of say like, hey, maybe you should wait for like a week before you use a new version.

36:57 assuming you're pinning by shock commit. And that's because like the community tends to actually find those malicious attacks or malicious code injections on public libraries given enough time. So there's more chance of malicious script being found by the community. If you wait like a week or so before updating. Of course we used to say like update all the time, but no one was updating all the time anyway, so this is fine You can just wait a week before updating for most things If there's a critical vulnerability for something and you have to update ASAP.

37:34 That's fine. You can still do that Now if you're an open source maintainer, please enable MFA everywhere stop using classic GitHub classic tokens, those help marginally. Audit GitHub actions. So for that, there's a few tools like a boost security has a tool called poutine. And I'm a fan of Zizmor by Will Woodruff. So Zizmor is a GitHub actions scanner. So in the first blog post by step security, which by the way, incredible blog post by Varun Sharma, like really good post here that really like a lot to learn from like what could go wrong in misconfigurations of GitHub actions.

38:12 So yeah, I I recommend you run Zizmor more. It's an open source free to use tool that can flag some of the common misconfigurations in GitHub actions that can lead to compromises like the one we've seen. Now remember we said that initially they were pointing to Recroll on YouTube? Now they started updating their YouTube repertoire. I need my headphones for this. So, Charlie Erickson said that this morning they changed it to actually play Dido Thank You instead of Rick Roll.

38:49 It's the song. Banger by the way. Like so good. And then there's more. they actually then updated so that they're embedding malware in doc.wav files. They're really starting a radio. They basically Base64 decode things that are embedded in the WAV itself, which is super interesting as an idea. And then the canister changes again. Now it points to... A song by King Gizzard and the Lizard Wizard, incredible band by the way.

39:19 Huge fan of them. Love this. And I have a suggestion to make if the team PCP DJ is taking requests. I think they should add this one, Rock Lobster by B52s. This is the energy I get from them, from Team PCP. Overall, this has been one of the most interesting campaigns I've seen, and it's still ongoing.

39:49 And honestly, good luck to them. mean, at least it's some creative attacks, targeting GitHub actions, using AI, trying prompt injection, using local coding agents with malicious prompts in them. I mean, what is there not to like about this incredible work?