Listen to this Post
On March 14th, a widely used GitHub repository (tj-actions/changed-files) was compromised due to leaked PAT (Personal Access Token) tokens. Attackers exploited this to leak secrets during builds. This incident underscores the critical need for secure code integration practices.
How to Safely Use External Code
1. Use Official Repositories
- Verify the repository URL to avoid lookalike phishing repos.
- Example: Check `https://github.com/tj-actions/changed-files` (official) vs. malicious clones.
2. Inspect Code Quality
– Manually review critical dependencies before integration.
– Use `git clone` and audit:git clone https://github.com/tj-actions/changed-files.git cd changed-files && git log -p Review commit history
3. Pin to Commit Hashes, Not Tags
- Tags can be reassigned; hashes are immutable.
- Bad: `uses: tj-actions/[email protected]` (tag)
- Good: `uses: tj-actions/changed-files@a1b2c3d` (hash)
4. Rotate Exposed Secrets Immediately
- If secrets leak, revoke them via:
GitHub PAT revocation gh api -X DELETE /settings/tokens/TOKEN_ID
- Audit logs with:
git log --grep="secret" Search for accidental commits
You Should Know: Preventing Supply Chain Attacks
- Verify Dependencies with `git verify-commit`
git verify-commit a1b2c3d Checks GPG signatures
- Use GitHub’s Dependency Graph
Enable in repo settings:
gh repo enable-vulnerability-alerts -R owner/repo
– Automate Security Scans
Integrate `trivy` for CI/CD:
trivy fs --security-checks=config,secret,vuln /path/to/repo
What Undercode Say
This incident highlights the fragility of open-source supply chains. Key takeaways:
– Immutable References: Always use commit hashes in CI/CD (actions/checkout@a1b2c3d).
– Secret Management: Store tokens in GitHub Secrets or Vault, not in code.
– Monitoring: Set up alerts for dependency changes (dependabot.yml).
Linux/Windows Commands for Security
- Check File Integrity (Linux):
sha256sum important_file Compare against known hash
- Audit SSH Keys (Windows):
Get-ChildItem ~.ssh.pub List authorized keys
- Block Suspicious IPs (Linux):
sudo iptables -A INPUT -s MALICIOUS_IP -j DROP
Expected Output:
A secure pipeline with pinned dependencies, automated scans, and no exposed secrets.
References:
References:
Reported By: Mrybczynska On – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
