Mysterious .bat files being force-pushed to all repositories - potential security concern #185880
Replies: 5 comments 18 replies
-
|
This is a classic signature of a Supply Chain Attack or a Token Leak. The fact that you see .bat files while being on macOS suggests that an automated bot is targeting your CI/CD environment or using a compromised Windows machine to push code. Here is a checklist to help you identify and stop the breach:
Go to your Organization Settings > Compliance > Audit Log. Search for the push events. Check the IP address and the Actor. Look for the auth_method. Was it a Personal Access Token, a GitHub App, or an SSH Key?
Revoke all PATs: If you use Personal Access Tokens, revoke them immediately. Check GitHub Apps: Go to Settings > GitHub Apps and Installed GitHub Apps. Revoke any suspicious third-party integration you don't recognize. Branch Protection: Enable "Lock branch" or "Restrict pushes" on your main branches. Disable "Allow force pushes" in your Branch Protection Rules. This is your best defense against history rewriting.
Inspect the content of a .bat file. Does it contain a PowerShell script, an IP address, or an attempt to download a payload (e.g., curl or certutil)? Often, these scripts are designed to steal environment variables (Secrets) from your CI/CD runners (GitHub Actions).
Since the history was force-pushed, you might need to use git reflog on a clean local machine to recover your previous state and force-push the "clean" version back. Stay safe, and don't hesitate to contact GitHub Support directly if you suspect a platform-level compromise of your account. |
Beta Was this translation helpful? Give feedback.
-
|
This behavior is a major red flag for a Supply Chain Attack. The forced pushes and the appearance of .bat files suggest that an automated bot has likely compromised one of your Personal Access Tokens (PAT) or Static Credentials (like AWS Access Keys) stored in your GitHub Secrets. While rotating keys is the first step, the long-term architectural solution to prevent this is implementing OIDC (OpenID Connect). Why OIDC is the answer to your problem: Short-Lived Tokens: GitHub Actions exchanges a temporary JWT (JSON Web Token) for short-lived cloud credentials that expire automatically. Identity-Based Access: You can configure your Cloud provider (AWS/Azure/GCP) to only trust requests coming from your specific GitHub Organization, Repository, and even a specific Branch. Immediate Action Plan: Enable Branch Protection: Immediately toggle "Block force push" and "Require Pull Request" on your main branches. This would have physically blocked the bot from overwriting your history. Switch to OIDC: Replace your static secrets with a Cloud Identity Provider (IdP) trust relationship. By moving to OIDC, you eliminate the root cause: the existence of permanent, exfiltratable credentials in your environment. Stay safe! |
Beta Was this translation helpful? Give feedback.
-
|
This is a legitimate security concern, and you’re right to treat it seriously — especially because these are force pushes across multiple repos. Here’s how to think about it and what to do immediately. What this almost certainly is (and isn’t)Since:
This is not a local git issue and not accidental user behavior. The most common causes in cases like this are:
Step 1: Identify who made the force pushes (critical)For one affected repo, run: git log --show-signature --oneline --decorateThen check on GitHub:
This will usually tell you immediately whether this was:
Step 2: Audit org-level integrations (very common culprit)In Organization Settings:
Look for:
If you see an app you don’t fully recognize → disable it immediately. Step 3: Rotate credentials NOW (don’t wait)Even if you’re not 100% sure yet, rotate as a precaution:
This is standard incident response, not overreacting. Step 4: Lock this down so it can’t happen againEnable / verify branch protection rules:
This turns a scary incident into a contained one. Step 5: Check GitHub security logsIn Organization → Security → Audit Log, filter by:
This will show exactly what actor performed the pushes and when. Important note about
|
Beta Was this translation helpful? Give feedback.
-
|
We got the same issue. If you have configuration files such as vite.config.js, postcss.config.js, etc., you may also find an additional script that starts with global['!'] =. Isn’t it interesting that all these PATs were leaked at the same time? |
Beta Was this translation helpful? Give feedback.
-
|
@aliziauddin |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Select Topic Area
Question
Body
Issue Summary
I'm experiencing a concerning issue where
.bat(Windows batch) files are being force-pushed to multiple repositories in our organization. This has happened twice in the last 3 days.Details
.batfilesWhat I've observed
.batfiles appearing across different reposConcerns
Questions
Any guidance would be greatly appreciated. This feels like a potential security issue.
Beta Was this translation helpful? Give feedback.
All reactions