11–20 of 237 posts
nodejs lack-of-QA comes back to bite them in the ass yet again. wasn't the first time nor will it be the last time, ditch this bullshit.
This is something I've always been concerned about with the node/NPM environment. Any project, even the smallest ones, have hundreds of dependencies. All it takes is some small lines of rogue code, and your entire project is vulnerable. Especially in JS, where you can do network requests and various critical actions all in one line of code.
[0]: http://left-pad.io
This is serious stuff and we will definitely see more of it in the future! As there are more and more node.js developers, it will be more profitable to run a scam like this and you only need to hijack one page that has a lot of dependencies, one package that is for example used by `express` to get access to a lot of users. The only thing you can do is be careful and listen for projects like node security.
Or use some other technology.
This is something I've always been concerned about with the node/NPM environment. Any project, even the smallest ones, have hundreds of dependencies. All it takes is some small lines of rogue code, and your entire project is vulnerable. Especially in JS, where you can do network requests and various critical actions all in one line of code.
The `left-pad` debacle a year ago[0] should've served as a wake up call to people writing projects with hundreds of dependencies. [0]: http://left-pad.io
Edit: spelling
Google autocomplete also suggests xss.hacktask.net
Looks like this guy is up to all kinds of no good.
This is important. It looks like the organization is submerging; they've deleted their NPM account and the package and emptied their GitHub repo. This should be signal boosted as hard as it can be managed, because this is rough stuff.
What can be done to help sort problems like this?
nodejs lack-of-QA comes back to bite them in the ass yet again. wasn't the first time nor will it be the last time, ditch this bullshit.
Explain to me how "QA" prevents a malicious package from transitively including another one and taking advantage of typo squatting.
Earlier quoted context omitted.
Explain to me how "QA" prevents a malicious package from transitively including another one and taking advantage of typo squatting.
QA prevents someone from adding a typo to the repository.
Of course they're not.
Looks like all the packages by this guy post to hacktask.net - a Chinese site. Google autocomplete also suggests xss.hacktask.net Looks like this guy is up to all kinds of no good.
For reference: https://twitter.com/o_cee/status/892306836199800836 since the user appears to have been nuked...
