You too can run malware from NPM (I mean without consequences)
1–10 of 122 posts
Re: You too can run malware from NPM (I mean without consequences)
#2LavaMoat looks great on paper, but not supporting Webpack HMR is a dealbreaker.
Re: You too can run malware from NPM (I mean without consequences)
#3npm should take responsibility and up their game here. It’s possible to analyze the code and mark it as suspicious and delay the publish for stuff like this. It should prevent publishing code like this even if I have a gun to my head
Re: You too can run malware from NPM (I mean without consequences)
#4LavaMoat looks great on paper, but not supporting Webpack HMR is a dealbreaker.
You're using HMR in your app's production bundle? How?
Re: You too can run malware from NPM (I mean without consequences)
#5npm should take responsibility and up their game here. It’s possible to analyze the code and mark it as suspicious and delay the publish for stuff like this. It should prevent publishing code like this even if I have a gun to my head
I think malware check should be opt-in for package authors, but provide some kind of 'verified' badge to the package.
Edit: typo
Re: You too can run malware from NPM (I mean without consequences)
#6How much money have the attackers stolen so far? Has someone done an analysis of the blockchains for the destination addresses?
Re: You too can run malware from NPM (I mean without consequences)
#7npm should take responsibility and up their game here. It’s possible to analyze the code and mark it as suspicious and delay the publish for stuff like this. It should prevent publishing code like this even if I have a gun to my head
i can guarantee you npm will externalize the cost of false-positive malware scans to package authors.
Re: You too can run malware from NPM (I mean without consequences)
#8How much money have the attackers stolen so far? Has someone done an analysis of the blockchains for the destination addresses?
click through to the article, it has a link to a view that lists the laughable profit
Re: You too can run malware from NPM (I mean without consequences)
#9I’ve been out of the loop with npm for a while, but are there still no package namespaces?
Re: You too can run malware from NPM (I mean without consequences)
#10Is it typical in the JS space to include dependencies without versioning?
Also, curious: does freezing a version really provide much protection? Shouldn’t a commit hash be used? (Attacker can change a tag.)