Repo Jacking: How GitHub exposes over 70,000 projects to remote code injection

The talk examines repo jacking, a supply chain weakness in which a GitHub username that has been renamed or deleted can be registered by anyone else. Any dependency that still points at the old name then loads code from the new owner's account, which can lead to code injection without the dependent project changing anything. The speaker describes how the issue was first noticed during a code review, when a dependency URL redirected to a different repository and, once the original account was free, could be taken over.

The speaker explains why renames and transfers are more dangerous than outright deletions, because GitHub's repository redirects keep old URLs working and so hide the exposure. GitHub's earlier mitigation blocked re-registration only for repositories with more than 100 clones in the week before a rename, which the speaker judged insufficient for small, rarely cloned libraries. The mass analysis combined GitHub's source archive with libraries.io dependency data, finding roughly 50,000 unregistered usernames, about 18,000 directly vulnerable projects, and around 70,000 impacted projects once transitive dependencies were followed to depth five.

For practitioners, the main advice is to avoid linking directly to GitHub repositories and to rely on package managers instead. Where direct links cannot be avoided, pinning to a full commit hash is safer than pinning to a tag or branch, though the speaker found that pinning can be bypassed in some package managers. Lock files help only where they carry integrity checks for the fetched code.