New Exploit Puts Thousands of GitHub Repositories and Millions of Users at Risk

A new vulnerability has been discovered in GitHub's repository creation and username renaming operations that could allow for a Repojacking attack. This technique could be used to hijack popular repositories and distribute malicious code. The vulnerability has been reported to GitHub and has been fixed. The vulnerability impacts over 4,000 code packages in languages such as Go, PHP, and Swift, as well as GitHub actions. GitHub has implemented measures to protect against this type of attack, but a new bypass method has been identified. It is recommended to avoid using retired namespaces and to use tools like ChainJacking to identify vulnerable packages.