Someone bought 30 WordPress plugins and planted a backdoor in all of them

But you won't get the equivalent of a sophisticated actor's spear-phishing efforts, highly customized supply chain attacks on likely vendor data, the individualized attention to not just blindly propagate when a developer downloads a hacked NPM package or otherwise gets a local virus... but to log into the company's SaaS systems overnight, pivot to senior colleagues, do crazy things like update PRs to simultaneously fix bugs while subtly adding injection surface areas, log into configuration systems whose changes aren't tracked in Git, identify how one might sign up as a vendor and trigger automatic payments to themselves with a Slack DM as cross-channel confirmation, etc.

The only thing holding this back from hitting every company is risk vs. reward. And when the likelihood of success, multiplied by the payout, exceeds the token cost - which might not happen with Mythos, but might happen with open source coding models distilled from it, running on crypto mining servers during times that minting is unprofitable, or by state actors for whom mere chaos is the goal - that threshold is rapidly approaching.

Actual malware? the plugins will get blocked.

Plugin randomly starts injecting javascript from a third party domain that displays some football related widget with affiliate links? they figured that's perfectly in the (new) owner's right and rejected any action even though it was a classic bait and switch with an entirely unrelated plugin.

At some point you have to assume it's by design.

If you want everything to be free, you don’t need it.

If you want everything to be centralized, you don’t need it. But being centralized, you introduce a massive single point of failure: the sysadmin of the network. Just look at how many attacks there have been, eg trying to backdoor SSH for instance.

Anyway… the answer to what you asked lies in the approach to updates. Why did you choose to run this update that had a virus?

Remember I mentioned pinned versions and M of N auditors signing off on each update? Start there. Why can’t these corporations with billions of dollars hire auditors to certify the next versions of critical widely used packages?

Or how about the community does these audits instead of just npm requiring two-factor authentication for the author? Even better — these days you could have a growing battery of automated tests writen by AI that operates an auditor and signs off on the result as one of the auditors.

This should be obvious. A city of people should have a gate, and the guards shouldn’t just import a trojan horse through a gate anytime at 3am. What is this LOL

Finally, I would recommend running untrusted apps and plugins on completely other machines than the trusted core. Just communicate via iframes. You can have postMessage and the protocol can even require human approval for some things. In that case byebye to worries about MELTDOWN and SPECTRE and other side-channel and timing attacks too.

I could go on and on… the rabbithole goes deep. I built https://safebots.ai in case you are curious to discuss more — get in touch via my profile.

Also I checked how many deps vuejs has, also 0.