4 ms·

Why Node? Why make a backdoor with a 90MB payload? Sorry guys, I should have fully read the article.

• matharmin 7y ago
  The article is about injecting a backdoor in a Node server using a malicious NPM package.
• bryanrasmussen 7y ago
  either because they think they have a bigger potential audience if Node is used, or because Node is what they know best.
  • giancarlostoro 7y ago
    I mean given how prevalent Node is for frontend theres a high possibility you could compromise a big enterprise companies proprietary code.
  • jetti 7y ago
    It is also a rather easy attack vector. Publish an npm package with this code and when people pull it into their project they will have opened up a backdoor.
  • ufmace 7y ago
    I think you can make a case that Node/NPM is more vulnerable to this than usual due to the huge number of packages pulled in by even simple applications. Can anybody really audit what 10k different packages are doing, and if any of them has had malicious code snuck in at some point?
    • eeZah7Ux 7y ago
      It's not just more vulnerable, it's incredibly so.
      • wesleytodd 7y ago
        Which platform do you use which does not rely on large amounts of open source libraries?
        • okareaman 7y ago
          Powershell has a security model. Also, Ryan Dahl (creator of node.js) is working on Deno as a replacement because he thinks he made a mistake with node. 10 Things I Regret About Node.js - Ryan Dahl https://www.youtube.com/watch?v=M3BM9TB-8yA https://www.youtube.com/watch?v=M3BM9TB-8yA
          • wesleytodd 7y ago
            Ryan is one person and not involved with node anymore. Deno also has many mistakes IMO, so fine to agree to disagree on this one.
            • okareaman 7y ago
              Interesting. You think he is making mistakes again? He complains about "second system syndrome." I've been using Deno for hobby projects and find a lot to like about it.
        • mikewhy 7y ago
          There's a bit more to it than that. The article touches on the fact that whats on npm doesn't have to match with what's on github (which is true for any package system that isn't 100% backed by source control).
      • benologist 7y ago
        It's not more vulnerable, it's as-vulnerable as any other package manager where anyone may upload code without sufficient review for people to blindly install and run. We have already seen this abused in browser extensions being repurposed to inject advertising, in node and ruby modules being converted to malware, cryptocurrency miners being added to games on Steam etc. There was even a Nintendo Switch game that bundled a Ruby IDE, I believe iOS has had apps surreptitiously bundling other software too.
• jetti 7y ago
  Not sure if you read the article or not but the author shows that this could be an npm package that, if included in a project, would open up a backdoor. The payload isn't large at all and the code base itself is small.
• fuj 7y ago
  If instead of trying to be snarky you would read the article you would understand why node is being used