3 ms·
You can see a list of all npm packages uploaded between the time that the first compromised eslint package was uploaded and the token invalidation time here: h
by thenewwazoo 8y ago
You can see a list of all npm packages uploaded between the time that the first compromised eslint package was uploaded and the token invalidation time here:
https://gist.github.com/thenewwazoo/0306aa06aafe7807497ed1db430ee2b8 https://gist.github.com/thenewwazoo/0306aa06aafe7807497ed1db...
- thenewwazoo 8y agoTo follow up, I've downloaded all of the versions indicated here and none include the strings `raw/XLeVP82h`, `sstatic1.histats.com`, nor `statcounter`, and none of the included `build.js` files contain `eval`. Not an exhaustive test.
- thenewwazoo 8y agoFurther follow up: I've updated the gist to include all packages between the time at which the first compromised package was uploaded and the time at which the keys were invalidated (which was later than the invalidation threshold). I'm working on auditing the larger (~2000) list of packages now.
- thenewwazoo 8y agoFinal follow-up: a more-exhaustive search also returned no evals in build.js files, nor any obviously-suspicious strings.
- vincnetas 8y agoHave you checked for \u0065val or e\u0076al or any other combination of it?
- sillysaurus3 8y agoThis is impossible in general. eval === this[[1,18,-3,8].map(x=>String.fromCharCode(x+100)).join("")] https://jsfiddle.net/hkvu9s47/ https://jsfiddle.net/hkvu9s47/
- vincnetas 8y agoThat's the point. That just checking for occurrences of strings like 'eval' just gives you false sense of security.