Open Source Groups Warn Of Ongoing Attacks

Two open source groups have warned of ongoing takeover attempts by malicious actors similar to one that affected a widely used component earlier this month.

Researchers at the OpenJS Foundation, which backs JavaScript-based projects, and the Open Source Security Foundation (OpenSSF) said they had blocked a “credible” hacking attempt affecting a popular JavaScript project and warned that other attacks may follow.

The researchers said a developer “wanted OpenJS to designate them as a new maintainer of the project despite having little prior involvement”, said OpenJS Foundation executive director Robin Bender Ginn and OpenSSF general manager Omkhar Arasaratnam in a joint statement.

The moves recalled a recent infiltration effort by a threat actor going by the name “Jia Tan” that targeted XZ Utils, a compression tool widely used in Linux systems, Ginn and Arasaratnam said.

Open source attacks

The attack on XZ Utils was developed over several years until it was finally uncovered earlier this month.

The researchers said OpenJS did not grant privileged access to the project that was targeted, adding that two other popular JavaScript projects that OpenJS does not host had also seen suspicious patterns.

OpenJS has reported the incident to the Cybersecurity and Infrastructure Security Agency (CISA) and the US Department of Homeland Security.

The researchers warned open source developers to remain alert for further attempts to compromise open source projects via social engineering methods.

Vulnerable ecosystem

Chris Hughes, chief security advisor at open source security company Endor Labs and a Cyber Innovation Fellow at CISA, said about one-quarter of all open source security projects have only one maintainer, with 94 percent having fewer than 10.

He said the open source ecosystem is highly opaque, with projects critical to digital infrastructure being maintained by individuals scattered around the world and often using unknown aliases.

“Many OSS projects are maintained by a single individual or small group of individuals – often in their spare time as a hobby or passion project and typically without any sort of compensation,” he said.

“This makes the entire ecosystem vulnerable to malicious actors preying on these realities and taking advantage of overwhelmed maintainers with a community making demands of them with no actual compensation in exchange for their hard work and commitment to maintaining code the world depends on.”