Security Issues Identified On GitHub

AI firms are leaving themselves open to data leaks

Two separate research studies have found companies are leaking information on GitHub, and the site itself is being targeted.

The first study, by security firm Wiz, found that a majority of AI companies – 65 percent of those in the Forbes AI 50 list – had leaked “verified secrets” on the developer platform.

The Forbes AI 50 includes major players like OpenAI, Anthropic and Perplexity, as well as new firms like Anysphere, Speak and Elon Musk’s xAI.

The leaked secrets included API keys, tokens and sensitive credentials, “often buried deep in deleted forks, gists, and developer repos most scanners never touch.”

Most vulnerabilities – but not all – are identified by basic scans, such as from GitHub’s integrated secrets scanner or corporate security tools. Wiz went deeper by looking at full commit histories and organization members (who can inadvertently check company-related secrets into their own public repositories and gists).

Two-thirds of the companies with a GitHub footprint were found to have leak instances, and Wiz had little luck contacting them to report its findings; almost half of disclosures either failed to reach the target – because “many companies lacked an official disclosure channel” - or received no response.

Companies are advised to mandate secret scanning through public version control systems, consider proprietary secret detection, and to ensure they have official disclosure channels.

Malicious Package Found Typo Squatting On GitHub

Veracode has also been scanning GitHub and identified a malicious npm package known as “@acitons/artifact”, that was typo squatting on the legitimate package @actions/artifact. The campaign is targeting users of the GitHub Actions CI/CD technology.

The intent appears to be to have a script execute during a build of a GitHub-owned repository, exfiltrate the tokens available to the build environment, then use those tokens to publish new malicious artefacts.

Veracode has identified six different versions of the script, including a post-install hook to download and run malware. However, the threat actor appears to have removed them. In addition, the malware has an expiry date: there was a mechanism to prevent execution after Nov. 6.

As noted above, the campaign targets GitHub-owned repositories. That is important to note: the malware appears to be specifically aimed at the GitHub organization itself, with the script ending if the organization running it was not GitHub.

The binaries and malicious versions of the package have, at the time of writing, been removed.

This article originally appeared on MES Computing’s sister site Computing.