4 ms·
It looks like no one is even sure what the code actually does? Or am I misreading that thread.
by bcherny 8y ago
It looks like no one is even sure what the code actually does? Or am I misreading that thread.
- deleted 8y ago[deleted]
- luizfzs 8y agoYou read it right
- bluehatbrit 8y agoSeems correct, the payload is encrypted with AES and it seems that a package.json description is the passphrase but the issue author hasn't been able to decrypt it so far (for reasons listed in the issue).
- geocar 8y agoIt's attacking a particular package -- some package out there depends on ps-tree directly or indirectly, and its description is the secret key.
- sroussey 8y agoWhich means there is a finite list to check, unless the package is something internal and not on npm.
- evan_ 8y agofrom the github issue it looks like a couple people are working on that using publicly available lists, and they've even found a few valid decryption keys, but none that turn the payload into executable javascript
- deleted 8y ago[deleted]
- wyldfire 8y agoNo one knows what it does but we do know that it seems to execute some encrypted bytecode. This seems remarkably unconventional and likely a good way to bundle malware.
- shittyadmin 8y agoLooks like they just cracked it in the comments - a bitcoin wallet stealer for an app that had it deep in the dependency tree.