For anyone who, like me, wasn't sure what's going on in the linked, archived PR: this is Mythos attempting to socially engineer a malicious PR during a test run by the UK AI Safety Institute.
Working with maintainers (on the GitHub side) there’s definitely been a rise of malware dropper attacks against popular OSS repos, though this is particularly brazen - pressure tactics and all.
jtakkala 55 minutes ago [-]
Not going to comment on the PR commentary, but the victim GitHub account is suspicious itself, recent account, a few fresh repos, following 14.5k others, and I count three surnames on the account (the username, plus two in the README history).
ncr100 45 minutes ago [-]
I saw a contribution by this maintainer to another user who ALSO HAS 14.5k followers: https://github.com/yumiaura/myCat/pull/99 "yumiaura" and a preference for "my[APPNAME]" repo naming.
What is this?
Are the histories that Github presents all derived from someone's uploaded git repo .. e.g. can I simply claim to have created a GIT repo in 1970, and the "github commit graph" will dutifully represent this claim in its green-colored activity graph?
0123456789ABCDE 49 seconds ago [-]
[delayed]
jtakkala 31 minutes ago [-]
They're almost certainly not genuine accounts, maybe used for karma farming, phishing, social engineering, future malware distribution?
andai 28 minutes ago [-]
What does this malware do? Who operates it?
ncr100 51 minutes ago [-]
Wait, who is the robot? Am I getting that right, someone in that thread is AI?
Erem 36 minutes ago [-]
I…I think there are no humans in that thread. Maybe only sinan-can-demir.
mekael 28 minutes ago [-]
I'm 99.9% sure that everyone is AI in that thread.
zezcko 59 minutes ago [-]
holy shit
gryfft 57 minutes ago [-]
Yeah, if this is the new normal I might start day drinking at some point in the coming weeks.
Rendered at 05:20:10 GMT+0000 (UTC) with Wasmer Edge.
Both the attacker and the target account are very similar and look fake/bots.
AISI has published a report about the incident which was preciously discussed on HN: https://news.ycombinator.com/item?id=49175717
What is this?
Are the histories that Github presents all derived from someone's uploaded git repo .. e.g. can I simply claim to have created a GIT repo in 1970, and the "github commit graph" will dutifully represent this claim in its green-colored activity graph?