Hackers are spoofing themselves as GitHub's Dependabot to steal user passwords

I don&#x27;t think I have ever accepted a pull request from Dependabot. I think that was already a stupid thing to do. Now it&#x27;s even more obvious that you shouldn&#x27;t accept a PR. Dependabot is a useful tool to <i>find</i> vulnerable dependencies, so that you can update them yourself.

From a very cursory skim, I get the feeling that this would only work on public repositories where pull requests are allowed, correct?<p>Not to minimize the issue, as that type of situation is likely the norm on GitHub.<p>Another way of phrasing what I mean: private repositories are unlikely to be affected by this correct? Since the spoofer would have no way to propose the threatening pull request, only the real dependabot would have permission to do that in that case.

The original source appears to be <a href="https:&#x2F;&#x2F;checkmarx.com&#x2F;blog&#x2F;surprise-when-dependabot-contributes-malicious-code&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;checkmarx.com&#x2F;blog&#x2F;surprise-when-dependabot-contribu...</a>

This whole story starts from the API token leak into the worst. I think, in a way, Github should reach out to the account holders if it sees a suspicious commit is getting pushed with some sort of security algorithm. I think that shouldn&#x27;t be that hard.

aquire a personal access token, reconfigure the account icons and labels to spoof dependabot, rely on complacency bred of familiarity, push malware as fix, steal credentials.<p>for good measure restore account config, and obfusicate history

Am I going crazy or did the majority commenters here not read the article?<p>These commits are not PRs. If I&#x27;m understanding this correct, the attacker got a hold of someone&#x27;s personal access token in some way, then used that to make a commit that creates a new GHA workflow, in which the workflow ex-filtrate all the secrets and env vars to their servers. The commit was made directly to the main (?) branch and set up to be run on all pushes. So the branch doesn&#x27;t even matter.<p>So it has nothing to do with automerging dependabot PRs. Sure you shouldn&#x27;t be doing that, but if your PAT is compromised, you&#x27;re done for anyway.<p>The reason dependabot is involved is because that commit <i>looks</i> like it came from dependabot, and that&#x27;s likely because the email on the git commit was set to dependabot, which GitHub would see and show as being from dependabot.

Apparently no one read the article, Dependabot was not compromised, no one accepted legitimate looking PRs, or anything else like that.<p>API tokens were stolen and then commits were made that spoofed dependabot&#x27;s name and style to avoid further scrutiny.

&quot;Hundreds of GitHub repositories have been targeted by a threat actor masked as the GitHub platform’s Dependabot feature to install password-stealing malware.&quot;

Just another reason not to use dependabot - it&#x27;s default configuration appears to be created to burn money on GH Actions &#x2F; Azure.