3 ms·
Can someone explain how the injection itself works? I assume it's the require doing the work, but its not so clear how that loads externally instead of from a p
by jononor 9y ago
Can someone explain how the injection itself works? I assume it's the require doing the work, but its not so clear how that loads externally instead of from a path in filesystem?
- dylz 9y agoIt appears to be middleware that looks at headers, and if a certain condition is met, it'll basically execute https://nodejs.org/api/vm.html#vm_vm_runinthiscontext_code_options https://nodejs.org/api/vm.html#vm_vm_runinthiscontext_code_o... against whatever the header has.
- ekke 9y agoNPM guys explain it in the blog today: https://news.ycombinator.com/item?id=16975025 https://news.ycombinator.com/item?id=16975025
- jononor 9y agoCorrected URL to blogpost is: https://blog.npmjs.org/post/173526807575/reported-malicious-module-getcookies https://blog.npmjs.org/post/173526807575/reported-malicious-...