4 ms·
This exploit is not NPM specific, could be any programming language. (Though NPM is a bit easier to exploit since there are so many packages and a large tree of
by tschellenbach 8y ago
This exploit is not NPM specific, could be any programming language. (Though NPM is a bit easier to exploit since there are so many packages and a large tree of deps)
- dkns 8y agoWould it be possible to put compromised package in Debian repository? Or has something like this happened in the past?
- flukus 8y agoIt's certainly possible but to my knowledge hasn't happened. This case specifically where a random person got the authority to publish new versions would be prevented by debians organisational policies. Other distro's are much less stringent and open to this kind of attack though, arch/yaort for instance will happily install straight from github and this exact scenario could have played out there. The gatekeeper model is a proven one, be it an organisation like debian, a paid curator like redhat or a locked down ecosystem like iOS.
- trickstra 8y agothe mindset where handing over a package with 2 million weekly downloads to a complete stranger is a totally OK thing to do IS npm specific.