reworm

Someone has maintainer/admin access to the repository and has force-pushed to master overwriting the git history. Notice that the original commit is verified: https://github.com/pedronauck/reworm/commit/df8c1803c519f599... While the malicious one is not: https://github.com/pedronauck/reworm/commit/d50cd8c8966893c6...

I don't quite understand how this is working tbh. I looked at one of the affected repos, ironically named "reworm". The malicious code was introduced in this commit - https://github.com/pedronauck/reworm/commit/d50cd8c8966893c6... It says coauthored by dependabot and refers to a PR opened in 2020 (https://github.com/pedronauck/reworm/pull/28). That PR itself was merged in 2020 here - https://github.com/pedronauck/reworm/commit/df8c1803c519f599... But the commit with the worm (d50cd8c), re-introduces the same change from df8c180 to the file `yarn.lock`. And when you look at the history of yarn.lock inside of github, all references to the original version bump (df8c180) are gone...? In fact if you look at the overall commit history, the clean df8c180 commit does not exist. I'm struggling to understand what kind of shenanigans happened here

In this instance the PR that was merged was from 6 years ago and was clear https://github.com/pedronauck/reworm/pull/28. Looks to me like a force push overwrote the commit that now exists in history since it was done 6y later.

Looks like the repo owner force-pushed a bad commit to replace an existing one. But then, why not forge it to maintain the existing timestamp + author, e.g. via `git commit --amend -C df8c18`? Innocuous PR (but do note the line about "pedronauck pushed a commit that referenced this pull request last week"): https://github.com/pedronauck/reworm/pull/28 Original commit: https://github.com/pedronauck/reworm/commit/df8c18 Amended commit: https://github.com/pedronauck/reworm/commit/d50cd8 Either way, pretty clear sign that the owner's creds (and possibly an entire machine) are compromised.