4 ms·
Isn't it scary that this seems to have been discovered only because the backdoor code was buggy?
by 0x0 8y ago
Isn't it scary that this seems to have been discovered only because the backdoor code was buggy?
- blablabla123 8y agoBuggy code is a top indicator that something on a deeper level is wrong. Assuming that the people who wrote the code were not in a total rush and quite smart, how could they write buggy code if the code base was healthy and robust? Especially on a project that is unit-tested and linted, without checking I assume everything on ESLint is...
- kevindqc 8y agoHow can the exploiter write buggy code? By... writing buggy code? From what I gather, they wrote some code that downloads a script, which might (or not) get downloaded in chunks. But their code only executes the first chunk. So if the whole script is not in the first chunk, you get a syntax error because it is incomplete. That exploited code was not in Github, it was added to the ESLint code the exploiter had, which he then published to npm using stolen credentials, bypassing the normal CI process. How would unit tests and linting help with that?
- BinaryIdiot 8y agoConsidering how you pretty much need 1,000+ node modules just to run most framework hello worlds, yeah this is terrifying. But it's a well known problem, too, that no one seems to want to do anything about and with npm being a business that wants / needs people to download modules through them, I don't see this changing any time soon. Maybe Deno can help give a new, security focused life into JavaScript development.