Cloning a Repo Is Code Execution [Part 2] — Attacking the Trust Instead of the Code

In [Part 1] I pulled apart two compromises of one codebase by hand – a fake font that ran on folder-open, and a babel.config.js that turned every build into a remote-access trojan. Both, it turns out, belong to a publicly-documented campaign: public reporting attributes that family to a DPRK-linked actor tracked as PolinRider (also Void Dokkaebi). I didn’t prove that myself – my analysis was static – but the shared Tron dead-drop, the commit-spoofing tool, and the 166.88.54.158 C2 line up with what Trend Micro and others have published.

[Read More]

Monorepo with Turborepo and Docker Matrix on GitHub Actions: Selective Build Modified Packages

Optimizing Selective Docker Builds in a Turborepo Monorepo on GitHub Actions

Our GitHub Actions matrix containers build workflow was always building every container image in our Turborepo monorepo — even if only a few packages had actually changed. This not only resulted in increased build time but also inflated our operational cost. In this post, I’ll will outline how we tackled this issue and implementing a robust solution that leverages Turborepo’s dry-run capabilities and GitHub Actions caching to build Docker images only for the changed packages.

[Read More]