3 ms·

This is serious stuff and we will definitely see more of it in the future! As there are more and more node.js developers, it will be more profitable to run a sc

This is serious stuff and we will definitely see more of it in the future! As there are more and more node.js developers, it will be more profitable to run a scam like this and you only need to hijack one page that has a lot of dependencies, one package that is for example used by `express` to get access to a lot of users. The only thing you can do is be careful and listen for projects like node security.

romanovcode 9y ago
Or use some other technology.
- eropple 9y ago
  There are remarkably few dependency management systems not vulnerable to some variant of this attack.
  - DCoder 9y ago
    Then again, a project with <20 dependencies has fewer "entry points" for this attack than a typical NPM project with 500+ transitive dependencies.