Malicious code injection by compromised pull request branch names
Malicious code injection by compromised pull request branch names
Bug Code in the published wheel 8.3.41 is not what's in GitHub and appears to invoke mining. Users of ultralytics who install 8.3.41 will unknowingly execute an xmrig miner. Examining the file util...
You're viewing a single thread.
I never considered branch names to be a vector, but in hindsight it makes total sense when put into a workflow like that. What possibly surprised me even more, was that branch names weren't limited to basic characters or at least no special signs. I obviously see the case for all the extended characters outside the latin alphabet, such as Chinese characters, but I totally expected restrictions on special symbols like
",',/,\,;, etc./is used to separate the same branch in different repos. For exampleorigin/mainandremote/main. Surprising that the other stuff is legal thoughYou can still freely use
/in branch names. Having remote branches available asremote/branchis just a convenience, and you can delete or modify them locally. It’s common to use/in branch names, too.Okay? I'm well aware. I do so all the time
That's true, i didn't think about that when I wrote it.
I'm used to the world being pretty simple though, so for me that slash has always just been a visual representation of the location of the branch if that makes sense. We don't have to have a slash in the branch name, only to use it to represent where that branch is located. It could have been something git only used for presentation.