12 ms·

Unpkg.com hacked?

20 points by benaiah 9y ago

I've checked on both my local machine and on a VPS I run, and the following URL is 302 redirecting to a malicious JS script which pops up a confirmation window and then redirects to ads: SOURCE URL: https://unpkg.com/react@latest/dist/react.js MALICIOUS REDIRECT: https://compliance-jessica.xyz/a.php This is the URL recommended for in-browser development use by https://facebook.github.io/react/docs/installation.html Can anyone else replicate this?

davidkhess 9y ago
Seeing the same thing when trying to load Vue. Tweet from them: https://twitter.com/unpkg/status/852655106562564098 https://twitter.com/unpkg/status/852655106562564098 > We're experiencing some issues and working on it. Will post updates here as soon as we know more.
- benaiah 9y ago
  Yeah, one of the Twitter replies seems to indicate this is a widespread issue. EDIT: apparently it was a bad nameserver update: https://twitter.com/unpkg/status/852658357034827776 https://twitter.com/unpkg/status/852658357034827776
  - davidkhess 9y ago
    Hhhmmm. According to DNS, I'm talking straight at a Cloudflare IP and getting a redirect to adware when trying to load Vue. Evidence here: https://pastebin.com/wVCABkaA https://pastebin.com/wVCABkaA
murftown 9y ago
Yes, I experienced the same thing.
svdpeijl 9y ago
here too - same thing.. this is ridiculous what a HUGE blunder on unpkg.com part
NuclearFishin 9y ago
Looks like there was indeed an issue with a bad nameserver update: https://twitter.com/unpkg/status/852660203275276289 https://twitter.com/unpkg/status/852660203275276289
- trishtrish691 9y ago
  Contact thewhitehathacker2012@gmail.com for all you hacking jobs and if you suspect any unfaithfulness from your spouse or girlfriend , he is the best you can get just tell him you saw a post from Trishia or else he might not reply +15134003546
DorianDevelops 9y ago
Sucks just got this on my github portfolio page that I put up a few days ago. Any way to fix???
- benaiah 9y ago
  Certainly - download the original version of whatever scripts you're using and host them from your own domain, instead of unpkg.
  - shanecleveland 9y ago
    Create fallbacks for future cases: https://css-tricks.com/snippets/jquery/fallback-for-cdn-hosted-jquery/ https://css-tricks.com/snippets/jquery/fallback-for-cdn-host...
davidjgraph 9y ago
unpkg are reporting this as fixed. https://twitter.com/unpkg/status/852668919768694784 https://twitter.com/unpkg/status/852668919768694784. We got hit pretty hard for the 50 minutes or so the problem existed, Dropbox host their JS SDK lib on there...
deleted 9y ago
[deleted]
Erd0s6 9y ago
I was having this issue to but all good now. Should I be concerned about my computer being infected from this? Virus scans don't find anything
himlion 9y ago
Use subresource integrity and this would have affected you less. Still a non functioning site unfortunately.
CorySimmons 9y ago
We got close to trending on HackerNews yesterday when this happened. Suddenly every visitor was reporting alert dialogs saying they had a virus and our votes dropped off a cliff. Last time I ever go against my gut and semi-trust anything.
trishtrish691 9y ago
Contact thewhitehathacker2012@gmail.com for all you hacking jobs and if you suspect any unfaithfulness from your spouse or girlfriend , he is the best you can get just tell him you saw a post from Trishia or else he might not reply +15134003546
trishtrish691 9y ago
Contact thewhitehathacker2012@gmail.com for all you hacking jobs and if you suspect any unfaithfulness from your spouse or girlfriend , he is the best you can get just tell him you saw a post from Trishia or else he might not reply +15134003546