A fake gig and a git hook: an attempt to steal developer credentials

Frank Wiles — founder of REVSYS, a member of the Django Steering Council, and a well-known figure in the Python world — has described a targeted attack against him. The attackers aimed to run arbitrary code on his laptop, apparently to reach his GitHub account and the many client credentials he holds through REVSYS.

A plausible opening

It all looked like an ordinary project inquiry: someone asked whether REVSYS might take on a web app in the Ed Tech space — work the firm does regularly. Wiles offered to set up a call and shared a Calendly link. In return he was asked to review the project details beforehand and sign an NDA.

The "client" then shared a Dropbox folder with several directories of Markdown files. The spec was handwavey but fleshed out enough to pass for an MVP outline. At first Wiles missed the hidden .git folder inside.

Just switch to the NDA branch

Unable to find the non-disclosure agreement, he asked them to email it. He was told the NDA lived in a separate branch — he just needed to switch to it, fill it out, and return it before the meeting. That was the moment it clicked.

Wiles opened .git/hooks. It held the usual sample hooks with the .example suffix — and one real, active post-checkout hook. That hook fires when you switch branches, and almost no one uses it in practice, which gave the game away.

What the hook did

Carefully reading the script, Wiles found a textbook scheme. The hook reached out to a Vercel app acting as a command-and-control server, downloaded an OS-specific binary, made it executable, ran it, and then deleted itself.

Wiles reported the incident to the security teams at Dropbox and Vercel, hoping the accounts could be shut down before someone else was caught. He noted that the scammers were also impersonating an unsuspecting development shop owner as part of the ruse.

His takeaway is simple and unsettling: they didn't get him this time, but it would be easy to fall for. Git is part of everyone's daily workflow, and that very familiarity is what makes the attack dangerous. He urges fellow developers to stay vigilant and guard their credentials closely.

Source: Lobsters