3 ms·

I'm waiting for this to start happening to NPM modules. What a great way to quietly monitor and leverage nodejs websites.

• micaksica 9y ago
  As for this vector, credentials leaks have been littered across the community and they've been aware since 2015. See https://github.com/ChALkeR/notes/blob/master/Do-not-underestimate-credentials-leaks.md https://github.com/ChALkeR/notes/blob/master/Do-not-underest... for more information.
• tyingq 9y ago
  That seems likely. You can even go under the radar a bit. Pick a popular module that is commonly misspelled by end users. Clone it, rename it, and wait.
  • micaksica 9y ago
    There was a thesis on this a year ago: http://incolumitas.com/2016/06/08/typosquatting-package-managers/ http://incolumitas.com/2016/06/08/typosquatting-package-mana... After the "left pad" debacle, npm provided protection from typosquatting a deleted module: http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm
    • tyingq 9y ago
      Don't know that this npm module has bad intentions, but I'll bet some of the downloads were unintentional. https://www.npmjs.com/package/loadash https://www.npmjs.com/package/loadash 245 downloads in the last day.
      • micaksica 9y ago
        I pulled down this package. It is just a package.json file.
        • tyingq 9y ago
          Sure, but the number of downloads/day shows the potential of squatting on a typo.