ChainJacking is a tool to find which of your Go lang direct GitHub dependencies is susceptible to ChainJacking attack.

Last update: Nov 02, 2022

Overview

ChainJacking is a tool to find which of your Go lang direct GitHub dependencies is susceptible to ChainJacking attack. Read more about it here

Requirements

Python 3.6+ and pip
Go and it's binaries >= 1.13
GitHub token (for API queries)
- 💡 This token is used for read only purposes and does not require any permissions

Installation

pip install chainjacking

Using in CI Workflows

ChainJacking can be easily integrated into modern CI workflows to test new code contributions.

GitHub Actions

ci-example.mp4

Example configuration:

name: Pull Request

on:
  pull_request

jobs:

  build:
    name: Run Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/[email protected]
      - uses: actions/[email protected]
        with:
          python-version: '3.9'

      - name: ChainJacking tool test
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          python -m pip install -q chainjacking
          python -m chainjacking -gt $GITHUB_TOKEN

CLI

ChainJacking module can be run as a CLI tool simply as

python -m chainjacking

CLI Arguments

-gt - GitHub access token, to run queries on GitHub API (required)
-p - Path to scan. (default=current directory)
-v - Verbose output mode
-url - Scan one or more GitHub URLs
-f - Scan one or more GitHub URLs from a file separated by new-line

Example: Scan a Go project

navigate your shell into a Go project's directory, and run:

python -m chainjacking -gt $GH_TOKEN

cli-example.mp4

You might also like...

Automated GitHub profile content using the USGS API, Plotly and GitHub Actions.

Top 20 Largest Earthquakes in the Past 24 Hours Location Mag Date and Time (UTC) 92 km SW of Sechura, Peru 5.2 11-05-2021 23:19:50 113 km NNE of Lobuj

28 Oct 31, 2022

Dicionario-git-github - Dictionary created to help train new users of Git and GitHub applications

Dicionário 📕 Dicionário criado com o objetivo de auxiliar no treinamento de nov

1 Feb 7, 2022

Script to use SysWhispers2 direct system calls from Cobalt Strike BOFs

SysWhispers2BOF Script to use SysWhispers2 direct system calls from Cobalt Strike BOFs. Introduction This script was initially created to fix specific

101 Dec 20, 2022

Direct Multi-view Multi-person 3D Human Pose Estimation

Implementation of NeurIPS-2021 paper: Direct Multi-view Multi-person 3D Human Pose Estimation [paper] [video-YouTube, video-Bilibili] [slides] This is

253 Jan 5, 2023

APRS Track Direct is a collection of tools that can be used to run an APRS website

APRS Track Direct APRS Track Direct is a collection of tools that can be used to run an APRS website. You can use data from APRS-IS, CWOP-IS, OGN, HUB

42 Dec 29, 2022

Bootstraparse is a personal project started with a specific goal in mind: creating static html pages for direct display from a markdown-like file

1 Jun 15, 2022

Add your recently blog and douban states in your GitHub Profile

4 Dec 12, 2022

tox-gh is a tox plugin which helps running tox on GitHub Actions with multiple different Python versions on multiple workers in parallel

tox-gh is a tox plugin which helps running tox on GitHub Actions with multiple different Python versions on multiple workers in parallel. This project is inspired by tox-travis.

19 Dec 26, 2022

Fetch PRs from GitHub and analyze which ones are unmergeable

Set up token Generate a personal access token on GitHub. Add repo permissions. export GH_TOKEN="abcdefg" Pull PR data make Usually, GitHub doesn't h

1 Nov 5, 2021

ChainJacking is a tool to find which of your Go lang direct GitHub dependencies is susceptible to ChainJacking attack.

Related tags

Overview

Requirements

Installation

Using in CI Workflows

GitHub Actions

CLI

CLI Arguments

Example: Scan a Go project

You might also like...

Automated GitHub profile content using the USGS API, Plotly and GitHub Actions.

Dicionario-git-github - Dictionary created to help train new users of Git and GitHub applications

Script to use SysWhispers2 direct system calls from Cobalt Strike BOFs

Direct Multi-view Multi-person 3D Human Pose Estimation

APRS Track Direct is a collection of tools that can be used to run an APRS website

Bootstraparse is a personal project started with a specific goal in mind: creating static html pages for direct display from a markdown-like file

Add your recently blog and douban states in your GitHub Profile

tox-gh is a tox plugin which helps running tox on GitHub Actions with multiple different Python versions on multiple workers in parallel

Fetch PRs from GitHub and analyze which ones are unmergeable

Releases(v1.1.2)

v1.1.2(Nov 16, 2021)

1.1.2 (2021-11-16)

Bug Fixes

v1.1.1(Nov 16, 2021)

1.1.1 (2021-11-16)

Bug Fixes

v1.1.0(Nov 16, 2021)

Owner

Checkmarx

Custom Python code for calculating the Probability of Profit (POP) for options trading strategies using Monte Carlo Simulations.

🔩 Like builtins, but boltons. 250+ constructs, recipes, and snippets which extend (and rely on nothing but) the Python standard library. Nothing like Michael Bolton.

Introduction to Databases Coursework 2 (SQL) - dataset generator

chiarose(XCR) based on chia(XCH) source code fork, open source public chain

Checkers Project Built Using Python

Mini-calculadora escrita como exemplo para uma palestra relâmpago sobre `git bisect`

BlueBorne Dockerized

A pure-Python codified rant aspiring to a world where numbers and types can work together.

Example teacher bot for deployment to Chai app.

peace-performance (Rust) binding for python. To calculate star ratings and performance points for all osu! gamemodes

WaterAndScreenBreakReminders - A small python program that reminds to take a water break every 15 minutes and a screen break every 30 minutes

Code for Crowd counting via unsupervised cross-domain feature adaptation.

The Begin button and menu for the Meadows operating system. The start button for UNIX/Linux.

Script for resizing MTD partitions on a QNAP device in order to be available to upgrade from buster to bullseye

A simple wrapper to analyse and visualise reinforcement learning agents' behaviour in the environment.

✔️ Create to-do lists to easily manage your ideas and work.

dta Convert Dict To Attributes!

Broken Link Finder is a Burp Extension to detect broken links for a passive scanning domains and links.

Huggingface package for the discrete VAE used for DALL-E.

Cairo-math-64x61 - Fixed point 64.61 math library for Cairo / Starknet