4 ms·
The best part is when you get caught, you can just play dumb and say your npm credentials were compromised (assuming precautions were taken in not using a colle
by spiznnx 9y ago
The best part is when you get caught, you can just play dumb and say your npm credentials were compromised (assuming precautions were taken in not using a collection domain tied to you).
- ehsankia 9y agoIn this example situation, the author states: > I’ve now made several hundred PRs (various user accounts, no, none of them as “David Gilbertson”). Also > I go through all the passwords and credit card numbers I’ve collected and bundle them up to be sold on the dark web. So if you get caught, you don't actually exist and you've already sold it all without any traces.
- deleted 9y ago[deleted]
- deckard1 9y agoWorse than that, I think. You can claim the npm account that published the package has zero relation to your github page that hosts the untainted source. The amount of times I've gone to npmjs.com, looked for the "official" version of a package only to get lost in a web of conflicting version and ownership "signals" is staggering. And yet... if it's on npmjs.com, then it's going into your package.json. No one audits that thing. Unless there is an obvious bloat issue. And dependencies of dependencies? NEVER. We have something like 400MB of shit in our node_modules folder. There is no human on earth that could go through that. This is a few times the size of the entire Linux kernel, for context. And it's minified.