In [Part 1] I pulled apart two compromises of one codebase by hand – a fake font that ran on folder-open, and a babel.config.js that turned every build into a remote-access trojan. Both, it turns out, belong to a publicly-documented campaign: public reporting attributes that family to a DPRK-linked actor tracked as PolinRider (also Void Dokkaebi). I didn’t prove that myself – my analysis was static – but the shared Tron dead-drop, the commit-spoofing tool, and the 166.88.54.158 C2 line up with what Trend Micro and others have published.
Cloning a Repo Is Code Execution [Part 1] — Anatomy of a Repo-Borne Supply-Chain Attack
I gave a talk recently about the state of software supply-chain attacks, and afterwards people kept coming back to the two compromises I’d pulled apart by hand, more than to any of the industry-wide numbers. This post is the written version of that part. Part 2 will pull back to the wider picture (XZ Utils, tj-actions, Trivy, and what actually helps); this one stays on the two incidents I looked at directly.
[Read More]