Rendered at 05:05:29 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
cpcallen 4 minutes ago [-]
For anyone who, like me, wasn't sure what's going on in the linked, archived PR: this is Mythos attempting to socially engineer a malicious PR during a test run by the UK AI Safety Institute.
Working with maintainers (on the GitHub side) there’s definitely been a rise of malware dropper attacks against popular OSS repos, though this is particularly brazen - pressure tactics and all.
Not going to comment on the PR commentary, but the victim GitHub account is suspicious itself, recent account, a few fresh repos, following 14.5k others, and I count three surnames on the account (the username, plus two in the README history).
ncr100 30 minutes ago [-]
I saw a contribution by this maintainer to another user who ALSO HAS 14.5k followers: https://github.com/yumiaura/myCat/pull/99 "yumiaura" and a preference for "my[APPNAME]" repo naming.
What is this?
Are the histories that Github presents all derived from someone's uploaded git repo .. e.g. can I simply claim to have created a GIT repo in 1970, and the "github commit graph" will dutifully represent this claim in its green-colored activity graph?
jtakkala 16 minutes ago [-]
They're almost certainly not genuine accounts, maybe used for phishing or social engineering?
andai 14 minutes ago [-]
What does this malware do? Who operates it?
ncr100 36 minutes ago [-]
Wait, who is the robot? Am I getting that right, someone in that thread is AI?
Erem 21 minutes ago [-]
I…I think there are no humans in that thread. Maybe only sinan-can-demir.
mekael 13 minutes ago [-]
I'm 99.9% sure that everyone is AI in that thread.
zezcko 44 minutes ago [-]
holy shit
gryfft 43 minutes ago [-]
Yeah, if this is the new normal I might start day drinking at some point in the coming weeks.
AISI has published a report about the incident which was preciously discussed on HN: https://news.ycombinator.com/item?id=49175717
Both the attacker and the target account are very similar and look fake/bots.
What is this?
Are the histories that Github presents all derived from someone's uploaded git repo .. e.g. can I simply claim to have created a GIT repo in 1970, and the "github commit graph" will dutifully represent this claim in its green-colored activity graph?