4 ms·
Details about the event-stream incident
- tdumitrescu 8y agoYowza, very targeted: "The injected code targets the Copay application. When a developer at Copay runs one of their release build scripts, the resulting code is modified before being bundled into the application. The code was designed to harvest account details and private keys from accounts having a balance of more than 100 Bitcoin or 1000 Bitcoin Cash."
- mdekkers 8y agoThis attack started out as a social engineering attack. The attacker, posing as a maintainer, took over maintainership of the event-stream module. How is this even possible? Shouldn't repo's like this have some serious security measures in place?
- robin_reala 8y agoThe owner didn’t want to maintain it and gave it to the attacker when they asked.
- ToFab123 8y agoMany repos is just one or two people that work on it in their spare time.
- th3iedkid 8y agoHas something like this happened with any java packages like in Maven-Central or even Eclipse managed repos ?