How Attackers Use Social Engineering to Target Open-Source Maintainers
Summary
The article explains five tactics used to gain access to open-source projects, including phishing, trust-building and fake job lures, and offers maintainers practical steps to reduce account and supply-chain compromise risks.
Key points
- Attackers use phishing to steal maintainer credentials or tokens, including real-time interception of TOTP codes.
- Social engineering can exploit platform account-recovery and ownership processes to gain access without directly stealing credentials.
- Long-term community infiltration and pressure campaigns have been used to earn or accelerate access to projects, as described in the XZ Utils and event-stream cases.
- Fake interviews and collaboration offers can lead maintainers to install malware, giving attackers access to credentials and session tokens on their machines.
- Attackers may seek publishing rights to abandoned packages; the article also notes that purchasing a project or domain can transfer downstream trust.
- Recommended defenses include using hardware security keys, keeping publishing devices clean and separate, revoking long-lived tokens, enabling trusted publishing, and verifying proposed collaborators.
Article Details
- Topic
- Social engineering attacks targeting open-source software maintainers and supply-chain access
People
Dominic Tarrevent-stream maintainer who granted publishing rights to right9ctrl after a collaboration offer.jasonsaaymanAxios maintainer whose machine was compromised through a fake job-interview lure and malicious update.Jia TanMade sustained contributions to XZ Utils, including the malicious commits used to distribute a backdoor.Jordan HarbandPrimary maintainer targeted by an attacker who requested the restoration of a previously compromised account.Josh JunonMaintainer targeted by the chalk/debug phishing attack; later acknowledged he should have recognized the fraudulent support email.Lasse CollinXZ Utils maintainer targeted by a coordinated pressure campaign to replace him.
Threat Actors
Contagious InterviewNorth Korea-linked campaign using fake job interviews and collaboration lures to deliver malware.Jade SleetThreat actor cluster described in a GitHub security alert as luring targets into cloning and executing a malicious repository.right9ctrlUsed a collaboration offer to gain event-stream publishing rights and introduce malicious code.UNC1069Conducted the multi-stage campaign that compromised an Axios maintainer through a fake company and meeting, then a malicious update.
Products
AxiosAxios, Chalk, Debug, XZ Utils. What do all these open source projects have in common? Threat actors use social engineering to gain access to the legitimate project and pushed a new version containing malware.ChalkAxios, Chalk, Debug, XZ Utils. What do all these open source projects have in common? Threat actors use social engineering to gain access to the legitimate project and pushed a new version containing malware.Copaywas surgically targeted, with the malicious code only activating within the specific environment of the Copay cryptocurrency wallet. Maintainer Dominic Tarr later wrote: "if it's not fun anymore, you get literallyDebugAxios, Chalk, Debug, XZ Utils. What do all these open source projects have in common? Threat actors use social engineering to gain access to the legitimate project and pushed a new version containing malware.GitHubinstead of npmjs.com, where clicking the link surrendered their npm token. The attacker never touched the GitHub repository; the stolen token was enough to publish four malicious versions directly.Microsoft Teamsaccount, and profiles of other OSS maintainers to build credibility. They scheduled a meeting via Microsoft Teams. During the call, a prompt appeared claiming his system was out of date. He installed what he thoughtnpmWhy attackers use it: Maintainers hold the publishing keys. A stolen npm token bypasses just about every other security control on the package itself. Phishing is also cheap and scalable. The same email template can beplain-crypto-jsoffer the ability to add a mandatory delay before a new package version is automatically pulled. The plain-crypto-js decoy package used in the axios attack was only 18 hours old when it was used as a malicious payload;XZ UtilsAxios, Chalk, Debug, XZ Utils. What do all these open source projects have in common? Threat actors use social engineering to gain access to the legitimate project and pushed a new version containing malware.