ChainJacking is a tool to find which of your Go lang direct GitHub dependencies is susceptible to ChainJacking attack. Read more about it here
Requirements
- Python 3.6+ and pip
- Go and it's binaries >= 1.13
- GitHub token (for API queries)
-
đŸ’¡ This token is used for read only purposes and does not require any permissions
-
Installation
pip install chainjacking
Using in CI Workflows
ChainJacking can be easily integrated into modern CI workflows to test new code contributions.
GitHub Actions
ci-example.mp4
Example configuration:
name: Pull Request
on:
pull_request
jobs:
build:
name: Run Tests
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/[email protected]
- uses: actions/[email protected]
with:
python-version: '3.9'
- name: ChainJacking tool test
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
python -m pip install -q chainjacking
python -m chainjacking -gt $GITHUB_TOKEN
CLI
ChainJacking module can be run as a CLI tool simply as
python -m chainjacking
CLI Arguments
-gt- GitHub access token, to run queries on GitHub API (required)-p- Path to scan. (default=current directory)-v- Verbose output mode-url- Scan one or more GitHub URLs-f- Scan one or more GitHub URLs from a file separated by new-line
Example: Scan a Go project
navigate your shell into a Go project's directory, and run:
python -m chainjacking -gt $GH_TOKEN
28 Oct 31, 2022
1 Feb 7, 2022
101 Dec 20, 2022
253 Jan 5, 2023
42 Dec 29, 2022
1 Jun 15, 2022
4 Dec 12, 2022
19 Dec 26, 2022
1 Nov 5, 2021
11 Sep 19, 2022
3 Oct 27, 2022
20 Jan 06, 2023
5 Nov 08, 2021
14 Apr 10, 2022
5.3k Jan 03, 2023
3 Apr 24, 2022
30 Sep 13, 2022
3 Oct 04, 2022
552 Dec 28, 2022
2.6k Jan 01, 2023
96 Dec 30, 2022
18 Sep 19, 2022
35 Nov 22, 2022
14 Dec 25, 2022
1 Sep 30, 2022
5 Jul 28, 2021
131 Dec 17, 2022
9 Feb 06, 2022
2 Jun 09, 2022