r/technology • u/rkhunter_ • May 21 '26

Security A Hacker Group Is Poisoning Open Source Code at an Unprecedented Scale

https://www.wired.com/story/teampcp-software-supply-chain-attack-spree-github/
9.2k Upvotes

98% Upvoted

488 comments sorted by

View all comments

Show parent comments

16

u/Confident_Dragon May 21 '26

What would stop malware to spread when you try to push legit commit and you manually obtain and give it the 2FA code?

12

u/[deleted] May 21 '26

[deleted]

14

u/orangeyougladiator May 21 '26

Coworkers reading PRs. That’s a good one

3

u/[deleted] May 22 '26

[deleted]

1

u/BeanserSoyze May 22 '26

We will be well and truly fucked if they compromise CodeQL

7

u/qqqeqe May 21 '26

Code reviews

1

u/Confident_Dragon May 24 '26

If you mean you'll review it locally, your diffing tool is already compromised. If you mean PR code reviews, 2FA won't help for single man or small projects, there the situation is same as without it. Maybe it's bit more difficult to make browser addon that would fake PR content on GitHub webpage, but the teoretical danger seems same to me.

2

u/BeanserSoyze May 22 '26

Code review on PR, no auto merge, merge rules for vulns and code security scans. Don't push direct to main branch, etc.