59

Source document

[2025-08-19 19:35] foxhop.: ``` Exploiting this is as simple as following these steps: Get a free trial on CodeRabbit and register using a personal GitHub account Create a private repository and grant CodeRabbit access to it, so that it reviews PRs on that repository Create a PR that contains the following files: A .rubocop.yml file as shown above An ext.rb file as shown above Any other large enough dummy Ruby file so that CodeRabbit triggers the execution of Rubocop and does not skip the file Wait for CodeRabbit to perform the code review and run our malicious ext.rb file Collect the exfiltrated environment variables in the HTTP POST request received on our attacker-controlled server at 1.2.3.4 Here’s an illustration of our malicious pull request to better understand how it works: ``` [2025-08-19 21:42] ajaxdavis: the hackers probably should of just taken advantage of the hack instead of reporting it [2025-09-05 01:10] ajaxdavis: whats everyone building [2025-09-05 01:10] ajaxdavis: had this herniated disc for 3 weeks now, side development is almost nilch [2025-09-05 01:13] jonathan.poczatek: Need to stand up a business [2025-09-05 01:13] jonathan.poczatek: Like an LLC, instead of being a contractor [2025-09-05 02:39] ajaxdavis: same, how bad can stripe atlas be [2025-09-05 02:39] jonathan.poczatek: Is that what that's for? [2025-09-05 02:43] xenonfun: They just bundle setup of LLC, tho it's not that hard to do yourself. Most states it's all online, Ohio is a couple hours turnaround. Also might need/want an EIN which you can get free on IRS website. [2025-09-05 06:43] optionalsecurity: https://x.com/VisaNews/status/1963591718139289806?s=19 [2025-09-05 09:44] jonathan.poczatek: Oh fff [2025-09-05 09:55] ajaxdavis: gonna hook it up to my onlyfans [2025-09-05 09:55] ajaxdavis: simp efficiently [2025-09-05 10:45] jonathan.poczatek: lololol [2025-09-05 10:45] jonathan.poczatek: And you got that hooked up to an adult content video clip generator? [2025-09-05 10:45] jonathan.poczatek: How else are you going to field paid requests [2025-09-05 10:46] foxhop.: When he says simp he means it's attached to his PayPal & CashApp so he can tip the ladies with his agent so he doesn't have to touch the keyboard... [2025-09-05 10:47] foxhop.: 🤡 [2025-09-05 10:47] jonathan.poczatek: Totally got rekt on that one [2025-09-05 14:15] ajaxdavis: gonna make a google meets in 20 [2025-09-05 14:26] jonathan.poczatek: Oo [2025-09-05 14:26] jonathan.poczatek: Can I make it! Il make you host [2025-09-05 14:34] jonathan.poczatek: Ajax Call Friday, September 5 · 09:30 – 12:30 Time zone: America/Chicago Google Meet joining info Video call link: https://meet.google.com/gkm-efoj-rpd Or dial: ‪(US) +1 609-831-2540‬ PIN: ‪889 610 040‬# More phone numbers: https://tel.meet/gkm-efoj-rpd?pin=6998289167579 [2025-09-05 15:02] ajaxdavis: ^ no lol [2025-09-05 15:02] jonathan.poczatek: make it [2025-09-05 15:02] jonathan.poczatek: lol