Malicious crossenv package on npm
twitter.com
Malicious crossenv package on npm
1–10 of 237 posts
Re: Malicious crossenv package on npm
#2This is important. It looks like the organization is submerging; they've deleted their NPM account and the package and emptied their GitHub repo.
This should be signal boosted as hard as it can be managed, because this is rough stuff.
Re: Malicious crossenv package on npm
#3This is important. It looks like the organization is submerging; they've deleted their NPM account and the package and emptied their GitHub repo. This should be signal boosted as hard as it can be managed, because this is rough stuff.
What can be done to help sort problems like this?
Re: Malicious crossenv package on npm
#4This is serious stuff and we will definitely see more of it in the future! As there are more and more node.js developers, it will be more profitable to run a scam like this and you only need to hijack one page that has a lot of dependencies, one package that is for example used by `express` to get access to a lot of users.
The only thing you can do is be careful and listen for projects like node security.
Re: Malicious crossenv package on npm
#5This is important. It looks like the organization is submerging; they've deleted their NPM account and the package and emptied their GitHub repo. This should be signal boosted as hard as it can be managed, because this is rough stuff.
What can be done to help sort problems like this?
To be honest? I don't know. Bugs (or malicious end-runs) are only shallow with many eyes, and none of this has eyes on it.
Re: Malicious crossenv package on npm
#6This is something I've always been concerned about with the node/NPM environment. Any project, even the smallest ones, have hundreds of dependencies. All it takes is some small lines of rogue code, and your entire project is vulnerable. Especially in JS, where you can do network requests and various critical actions all in one line of code.
Re: Malicious crossenv package on npm
#7nodejs lack-of-QA comes back to bite them in the ass yet again. wasn't the first time nor will it be the last time, ditch this bullshit.
Re: Malicious crossenv package on npm
#8For reference: https://twitter.com/o_cee/status/892306836199800836
since the user appears to have been nuked...
Re: Malicious crossenv package on npm
#9This is serious stuff and we will definitely see more of it in the future! As there are more and more node.js developers, it will be more profitable to run a scam like this and you only need to hijack one page that has a lot of dependencies, one package that is for example used by `express` to get access to a lot of users. The only thing you can do is be careful and listen for projects like node security.
Or use some other technology.
Re: Malicious crossenv package on npm
#10[deleted]