3 ms·
It's attacking a particular package -- some package out there depends on ps-tree directly or indirectly, and its description is the secret key.
by geocar 8y ago
It's attacking a particular package -- some package out there depends on ps-tree directly or indirectly, and its description is the secret key.
- sroussey 8y agoWhich means there is a finite list to check, unless the package is something internal and not on npm.
- evan_ 8y agofrom the github issue it looks like a couple people are working on that using publicly available lists, and they've even found a few valid decryption keys, but none that turn the payload into executable javascript
- deleted 8y ago[deleted]