An innocuous example of a significant git backdoor.
Expanding the Base64 encoded tarball payload will result in a minimal example git repository.
base64 -di | tar xz
# (paste the base64 data, hit return, then press Ctrl+D)
# You will have a new repo folder called `ouchy`Simply running git status inside of it will cause a file to be executed.
Exploit explained
This requires some configuration of the local repository to use the fsmonitor hook callback, and for an executable file to be present,
so a plain clone should not carry such an item , but any script from a repo can introduce a surreptitious modification
to a repository database which could in turn become a sleeper calling home, curling code, and downloading executable scripts.
Beware!
Mitigation
Only get git repositories via cloning, never via any regular file sync or archive !