35,000 "hacked" GitHub repos were really search hits in malicious clones

Stephen Lacy’s alarm about 35,000 “hacked” GitHub repos turned out to be search hits for a malicious URL in clones of legitimate projects, more than 13,000 of them from a single repo called redhat-operator-ecosystem. The clones sent the host’s environment variables (API keys, tokens, AWS credentials) to a server under vps.myjino.ru and carried a one-line backdoor for remote code execution. Florian Roth published Sigma rules on the day of the report that flag DNS lookups of and network connections to that host, which promptly got the Sigma repository itself reported as malicious for containing the string. GitHub said no original repositories were compromised and quarantined the clones. Pull from the official repo, and remember that a commit showing the original author’s name proves nothing unless it is signed.