The https://github.com/hacksider/Deep-Live-Cam/blob/main/requirements.txt file has been compromised on the last commit.
See https://github.com/hacksider/Deep-Live-Cam/commit/7895c547a6788ee53e5c7c34e93454f86f6d2b53
<img width="2729" height="582" alt="Image" src="https://github.com/user-attachments/assets/4b61523b-dfd7-4adb-8474-b32f3aebea1d" />
The requests lib dependency now points to https://github.com/[pypls/requests](https://github.com/pypls/requests) which has a nice present on https://github.com/pypls/requests/blob/main/setup.py.
Thanks for this report, I had a report last night that my git have some issues and have some weird login even though I have 2fa. Fixed right now. I have changed all the passwords as well as the keys on my git.
Looks like this was part of an organized campaign. @hacksider Have you checked if any of the recent releases impacted?
We did a technical analysis of the payload here: https://safedep.io/deep-live-cam-supply-chain-attack/
Yes, I did. The first thing I did last night was to change all the passwords and review all the things to see how it was compromised (someone used my session in Russia, eventhough I am from Southeast Asia).
<img width="821" height="649" alt="Image" src="https://github.com/user-attachments/assets/3a0ad543-89de-4a6b-b744-68eef2ba59f6" />
I also checked all the reports on my firewall. I believe it was a session hijacking but I cant seem to trace how they did that. I already changed all my passwords, removed all active sessions both on my gmail and github as well as revoke all the application connection connecting to this repo to ensure that this wont happen again. I never expected this will happen as I have 2fa activated on all of my accounts, Sorry if something slipped but my priority is to secure all of my accounts first before anything else. Good thing someone reported this as well.
Here's the chain of notifications I have received last night before this incident
<img width="2156" height="126" alt="Image" src="https://github.com/user-attachments/assets/8557e64f-ff78-4eb9-8f46-a4ce3c6e3dac" />
This is to ensure everything is transparent as well.
Every keys are revoked after that. I also changed the password to ensure that no one can try to do it again. I have reviewed all the apps connecting to the github repo as well (everything removed as I was really paranoid on this incident).