[flagged]
[deleted]
Someone bought 30 WordPress plugins and planted a backdoor in all of them
11–20 of 368 posts
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#12Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
[flagged]
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#13So how was this attack gonna generate "revenue" for the attacker? What kind of info did they get hold of?
They inject backlinks, SEO spam to advertise payday loans, online pharmacy, casino and so on.
Just imagine you can get 30k of links to your website at once. Google will rank that page very high.
One pharmacy shop that sells generics or unlicensed casino can make tens of thousands of dollars per day. So even one week is enough to make a lot of money.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#14So how was this attack gonna generate "revenue" for the attacker? What kind of info did they get hold of?
They're adding backlinks to other sites. They're either making revenue from those sites, or (more likely) selling backlinks to unsavory products.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#15Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks. This is the best reason for letting users install from npm directly instead of bundling dependencies with the project.
What user is going to check dependencies like that?
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#16I see a future where there are LLM vetted repos for Java, Python, Go, etc... And it will cost $1 to submit a release candidate (even for open source) edit: The idea is the $1 goes towards the tokens required to scan the source code by an LLM, not simply cost a dollar for no other reason that raising the bar. First submission is full code scan, incremental releases the scanner focuses on the diffs.
That's what jfrog + artifactory is for, enterprise solved this problem long ago
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#17Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
There is a reason. The prevailing wisdom has thus far been: "don't re-invent the wheel", or it non-HN equivalent "there is an app for that". I am absolutely not suggesting everyone should be rolling their own crypto, but there must be a healthy middle ground between that and a library that lets you pick font color.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#18Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
[flagged]
[flagged]
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#19Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
[flagged]
I didn’t downvote it but it doesn’t seem particularly new or insightful. The points are quite shallow. Perhaps people come here for comments that offer an expert opinion or a bit more. As I say I didn’t downvote.
Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them
#20Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.
[flagged]
I'm sorry but does this have anything to do with npm? I just skimmed the article so maybe I missed it. So wordpress doesn't use npm, it doesn't even use composer, therefore this comment feels a bit disconnected. Maybe that's why?