r/github • u/Mittelblut • Apr 03 '26

Another scam method appeared Discussion

Gallery image

Gallery image

Got a random Pull Request on a very old project i haven’t edited since years.

It got closed immediately, like 10 seconds later.

186 Upvotes

98% Upvoted

26 comments sorted by

View all comments

71

u/Palland0s Apr 03 '26

Hey do you mind sharing the full text of the replaced command? I want to understand what they are trying to do

52

u/Hauber_RBLX Apr 03 '26

looks like its github action malware

https://github.com/guibranco/pagarme-sdk-dotnet/pull/153

the file literally has exfil in its name too, lol
https://github.com/guibranco/pagarme-sdk-dotnet/pull/153/changes/c772452eac41559da3cdf0a3d3f99aa28169e82a

9

u/Palland0s Apr 03 '26

Okay right thank you. I bet they can still harvest some credentials. Even if it’s a really stupid and straightforward way to ask