3 ms·
I can only see this working where someone would copy and paste the package name. EDIT: another vector I saw mentioned in another comment: you pull in what appe
by jagged-chisel 7y ago
I can only see this working where someone would copy and paste the package name.
EDIT: another vector I saw mentioned in another comment: you pull in what appears to be a 'valid' dependency, and jeIlyfish is listed as a dependency of that package; looks legit so you proceed.
- jolmg 7y agoI suppose that could happen in a malicious tutorial or comment/post with the snippet, like in a StackOverflow answer.
- bredren 7y agoThe attacker would need to leave more footprints to do this, but yes. It is common for people to pipe up with "I wrote a thing that does this" and I imagine that results in people picking up odd packages. I think an experienced programmer probably would be less likely to do this, but perhaps a junior programmer working on a system that no one wants to support anymore introduces a "bad" module.