Poisoned Pipeline

Poisoned Pipeline / Incidents / AS80

AS80 · 2026-04

Contagious Interview stage-2 in Git pre-commit / post-checkout hooks

Git / GitHubLinux distro / packagesmacOS softwareWindows softwareVS Code / IDE

OSM found Lazarus Contagious Interview / TasksJacker lures moving the
stage-2 loader out of .vscode/tasks.json into .githooks/pre-commit
(and post-checkout). The hook fingerprints uname -s and pipes a curl
from precommit.vercel.app into sh or cmd, always exiting 0 so the
commit looks fine. Same fake-recruiter coding-assessment social
engineering as AS41, earlier in the workflow — fires when the
candidate commits, and post-checkout fires on every branch switch.
Identical blob SHA seen across several DeFi-themed lure repos.

Mapped techniques

supply-chain git hook loader

T0111 · Resource Development · Malicious code contribution to an open-source repository

Lure repos ship .githooks/pre-commit and post-checkout.

T0151 · Execution · Installation scripts

Hook runs automatically on commit or checkout.

T0136 · Initial Access · Brandjacking

precommit.vercel.app impersonates the pre-commit framework.

T0172 · Execution · Runtime backdoor

Per-OS second stage toward InvisibleFerret-style theft.

Sources