Researchers Warn of Potential RepoJacking Vulnerability in Millions of GitHub Repositories
Security researchers from AquaSec’s Nautilus team have issued a warning stating that millions of GitHub repositories could be susceptible to a type of attack known as dependency repository hijacking, or “RepoJacking.” This vulnerability could enable attackers to carry out supply chain attacks that impact a significant number of users.
The researchers analyzed a sample of 1.25 million GitHub repositories and discovered that approximately 2.95% of them were vulnerable to RepoJacking. Extrapolating this percentage to GitHub’s total repository base of over 300 million, it is estimated that around 9 million projects could be affected.
RepoJacking occurs when a malicious actor registers a username and creates a repository that was previously used by an organization but has since changed its name. This invalidates the redirection created to prevent dependencies from breaking in projects that utilize code from repositories with name changes. As a result, projects or code relying on the attacked project’s dependencies may unknowingly fetch code and dependencies from the attacker-controlled repository, which could contain malware.
While GitHub has implemented defenses against RepoJacking, AquaSec reports that these solutions have been incomplete and easily circumvented. GitHub’s current protections primarily cover highly popular projects, but vulnerabilities can still exist in less popular repositories that these projects rely on, leading to a supply chain compromise.
To illustrate the severity of the issue, AquaSec conducted scans on prominent organizations and identified exploitable cases in repositories managed by Google and Lyft. For example, a readme file in Google’s project “Mathsteps” contained instructions that pointed to a GitHub repository owned by Socratic, a company acquired by Google and no longer in existence. By cloning this repository, an attacker could manipulate the redirection, potentially exposing users who followed the instructions to download malicious code.
Similarly, AquaSec found an installation script in Lyft’s repository that fetched a vulnerable ZIP archive from another repository. An attacker registering a new username and repository with matching names could inject their code into Lyft’s “install.sh” script, potentially compromising users who executed the script.
RepoJacking poses a widespread and challenging risk to organizations and users. To mitigate this threat, project owners should minimize reliance on external repositories as much as possible. Furthermore, owners should consider retaining control over repositories associated with old brands or acquired entities to prevent dependency hijacking attacks on themselves and their users.
