4 ms·

Looks like they are using unpkg.com and npm to distribute the badware: https://unpkg.com/copyfish-npm-2-8-5@1.0.1501416918/ https://unpkg.com/copyfish-npm-2-8-

Looks like they are using unpkg.com and npm to distribute the badware: https://unpkg.com/copyfish-npm-2-8-5@1.0.1501416918/ https://unpkg.com/copyfish-npm-2-8-5@1.0.1501416918/ https://www.npmjs.com/package/copyfish-npm-2-8-5 https://www.npmjs.com/package/copyfish-npm-2-8-5 I reached out to both services to have it shut down. Hopefully that will at least kill it temporarily.

joshschreuder 9y ago
Unpkg has a blacklist, so you can put up a PR if you know the package IDs. https://github.com/unpkg/unpkg.com/commit/ac09a03c75a51997b909a63546f9773ca9aeb837 https://github.com/unpkg/unpkg.com/commit/ac09a03c75a51997b9... A similar thing happened with another Chrome extension Social Fixer about a month ago. EDIT: It's already been blocked, nice work @mjackson https://github.com/unpkg/unpkg-website/commit/7d4a4ba4958c16d1b8d57876bc8931b7b8364d5e https://github.com/unpkg/unpkg-website/commit/7d4a4ba4958c16...