11–18 of 18 posts
Can someone explain how the injection itself works? I assume it's the require doing the work, but its not so clear how that loads externally instead of from a path in filesystem?
And NPM took it down quickly, whew.
And NPM took it down quickly, whew.
did you report it to NPM?
I don't know who to credit on this, and neither does npm but OP seems to be the source of these findings, although it would baffle me if they didn't report it to npm.
There is no reason to use "express-cookies" when "cookie-parser" exists.
Can someone explain how the injection itself works? I assume it's the require doing the work, but its not so clear how that loads externally instead of from a path in filesystem?
NPM guys explain it in the blog today: https://news.ycombinator.com/item?id=16975025