Top.gg supply chain attack highlights subtle risks

Threat actors compromised multiple GitHub accounts and made malicious commits to several GitHub code repositories, including that of a popular Discord server and bot discovery platform, highlighting the subtle but serious risks of software supply chain attacks.

Application security vendor Checkmarx published research Monday dedicated to a threat campaign it observed involving unidentified threat actors. According to Checkmarx researchers, attackers "distributed a malicious dependency hosted on a fake Python infrastructure, linking it to popular projects on GitHub and to legitimate Python packages."

The actors took over influential GitHub accounts and made malicious commits to popular GitHub organizations. One affected organization that Checkmarx highlighted was Top.gg, whose official Discord server maintains more than 170,000 members.

On March 3, Checkmarx said, users of the Top.gg Discord server notified user "editor-syntax," a contributor with write permissions to Top.gg's Git repositories, that malicious activity was originating from their GitHub account.

As it turned out, attackers had compromised the account and used the access to poison Top.gg's repository. "It became evident that the malware had compromised multiple individuals, highlighting the scale and impact of the attack," Checkmarx's blog post read.

Checkmarx said editor-syntax was likely compromised via the account's session cookies, allowing attackers to bypass authentication entirely. "This method of account takeover is particularly concerning, as it does not require the attacker to know the account's password," the blog post read.

This was one of multiple tactics, techniques and procedures the threat actors used during the campaign. In another instance, researchers said the actors copied popular software development tool Colorama, injected malicious code and hosted it on a fake Python package site using a typosquatted URL.

"The multi-stage and evasive malicious payload harvests passwords, credentials, and more dumps of valuable data from infected systems and exfiltrates them to the attacker's infrastructure," Checkmarx said.

Jossef Harush Kadouri, head of software supply chain security at Checkmarx and an author of the blog post, told TechTarget Editorial that researchers discovered the campaign through indicators of compromise discovered in a malicious package. Asked how many users of the 170,000-plus could have been compromised in Top.gg's repository poisoning, Kadouri said, "It's hard to tell." He said Checkmarx's blog post assertion that "over 170,000" users were affected "was an assumption based on the Discord community size."

In a statement shared with TechTarget Editorial, a GitHub spokesperson said the company was aware of the report and that GitHub itself did not experience a compromise as a result of the activity described in the research.

"GitHub hosts over 100M developers building across over 420M repositories, and is committed to providing a safe and secure platform for developers," the spokesperson said. "We have teams dedicated to detecting, analyzing, and removing content and accounts that violate our Acceptable Use Policies. We employ manual reviews and at-scale detections that use machine learning and constantly evolve and adapt to mitigate malicious usage of the platform. We also encourage customers and community members to report abuse and spam."

TechTarget Editorial reached out to Top.gg for additional comment, but did not receive a response at press time