3 ms·
The author suggests a malicious attacker might typosquat common packages and embed the exploit in a readme. But if the user is already downloading your package
by chatmasta 9y ago
The author suggests a malicious attacker might typosquat common packages and embed the exploit in a readme.
But if the user is already downloading your package, why bother with an exploit? You’ve got all the permissions allocated to packages (which I imagine are most permissions). You can just execute the malicious code directly from the package.
Edit: nvm
- detaro 9y agofrom the article: > So a malicious attacker would just have to register a bunch of malicious packages for every letter or offer a few packages with similar names to existing ones. As soon as someone clicked on the name to see the full entry (not installing it!), the malicious code would already be executed.
- chatmasta 9y agoMy bad, missed that part. Yikes.