Someone bought 30 WordPress plugins and planted a backdoor in all of them • Hacker News Board

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#41

Post by bastardoperator » Mon, Apr 13, 2026, 7:02 PM UTC

bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

Nearly every package manager does this. You would never get work done if you had to inspect every package. Services like renovate and dependabot do this lifting at no cost to the js developer, and probably do it better.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#42

Post by bluGill » Mon, Apr 13, 2026, 7:02 PM UTC

dec0dedab0de wrote: post #34

bluGill wrote: post #15

Earlier quoted context omitted.

What user is going to check dependencies like that?

I was really saying that if there is a compromised version that gets removed from NPM, then the projects using it do not need to be updated, unless of course they had the compromised version pinned. Though plenty of orgs centralize dependencies with something like artifactory, and run scans.

If someone detects it is asking a lot.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#43

Post by kibwen » Mon, Apr 13, 2026, 7:02 PM UTC

bluGill wrote: post #15

dec0dedab0de wrote: post #9

Earlier quoted context omitted.

The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks. This is the best reason for letting users install from npm directly instead of bundling dependencies with the project.

What user is going to check dependencies like that?

Users who don't care about security are screwed no matter what you do. The best you can do is empower those users who do care about security.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#44

Post by bigbuppo » Mon, Apr 13, 2026, 7:02 PM UTC

iugtmkbdfil834 wrote: post #17

bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

There is a reason. The prevailing wisdom has thus far been: "don't re-invent the wheel", or it non-HN equivalent "there is an app for that". I am absolutely not suggesting everyone should be rolling their own crypto, but there must be a healthy middle ground between that and a library that lets you pick font color.

I would say the solution is to make it small and ugly, back to the way it was in the pre-Web-2.0 era, but SQL injections were a thing back then, and they're still a thing today, it's just now there are frameworks of frameworks built on top of frameworks that make fully understanding a seemingly-simple one liner impossible.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#45

Post by toniantunovi » Mon, Apr 13, 2026, 7:04 PM UTC

The supply chain attack surface in WordPress plugins has always been particularly dangerous because the ecosystem encourages users to install many small single-purpose plugins from individual developers, most of whom aren't security-focused organizations. Buying out an established plugin with a large install base is a clever approach because you inherit years of user trust that took the original developer a long time to build.

The deeper structural issue is that plugin update notifications function as an implicit trust signal. Users see "update available" and click without questioning whether the author is still the same person. A package signing and transfer transparency system similar to what npm has been working toward would help here, but the WordPress ecosystem has historically moved slowly on security infrastructure.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#46

Post by tarkin2 » Mon, Apr 13, 2026, 7:04 PM UTC

bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

Isn't this the same for maven, python, ruby projects too? I don't see this as a web only problem

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#47

Post by mrbuttons454 » Mon, Apr 13, 2026, 7:05 PM UTC

monarchwadia wrote: post #25

iugtmkbdfil834 wrote: post #17

Earlier quoted context omitted.

There is a reason. The prevailing wisdom has thus far been: "don't re-invent the wheel", or it non-HN equivalent "there is an app for that". I am absolutely not suggesting everyone should be rolling their own crypto, but there must be a healthy middle ground between that and a library that lets you pick font color.

Anecdata from a JS developer who has been in this ecosystem for 14 years. I'm actively moving away from Node.js and JavaScript in general. This has been triggered by recent spike in supply chain attacks. Backend: I'm choosing to use Golang, since it has one of the most complete standard libraries. This means I don't have to install 3rd party libraries for common tasks. It is also quite performant, and has great suppo…

I'm going almost the same direction, for the same reasons. Golang seems very interesting. Rewriting some hobby projects to get an understanding of the language and ecosystem. I'm on Node/webpack now and don't love where things are going.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#48

Post by Kaliboy » Mon, Apr 13, 2026, 7:06 PM UTC

tarkin2 wrote: post #46

bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

Isn't this the same for maven, python, ruby projects too? I don't see this as a web only problem

Node is on another level though.

It's cause they have no standard library.

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#49

Post by jruohonen » Mon, Apr 13, 2026, 7:06 PM UTC

chromacity wrote: post #32

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec. We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specifi…

> but they don't need FreeBSD exploit-writing capabilities for that.

That's a solid point. There was a piece the other day in the Register [1] that studying supply chains for cost-benefit-risk analysis is how some of them increasingly operate. And, well, why wouldn't they if they're rational (an assumption that is debatable, of course)?

[1] https://www.theregister.com/2026/04/11/trivy_axios_supply_ch...

Re: Someone bought 30 WordPress plugins and planted a backdoor in all of them

#50

Post by epistasis » Mon, Apr 13, 2026, 7:09 PM UTC

tarkin2 wrote: post #46

bradley13 wrote: post #7

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded. The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

Isn't this the same for maven, python, ruby projects too? I don't see this as a web only problem

Yes, and it isn't the only problem.

I think the continuous churn of versions accelerates this disregard for supply chain. I complained a while back that I couldn't even keep a single version of Python around before end-of-life for many of the projects I work on these days. Not being able to get security updates without changing major versions of a language is a bit problematic, and maybe my use cases are far outside the norm.

But it seems that there's a common view that if there's not continually new things to learn in a programming language, that users will abandon it, or something. The same idea seems to have infected many libraries.