3 ms·
> compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack. Which makes me think: A bad actor could create a really
by young_unixer 6y ago
> compromise a widely used package and sleep on it until it was pervasive enough to be a valuable hack.
Which makes me think: A bad actor could create a really good open source library or package, wait for everyone to use it and then introduce malware into it. Or they could "accidentally" add a security vulnerability and exploit it.
"There is another theory which states that this has already happened."
- monkpit 6y agoWhile this is true, it’s probably MUCH easier to just exploit existing packages in some fashion.
- gkanai 6y ago> A bad actor could create a really good open source library or package, wait for everyone to use it and then introduce malware into it. This often happens with Chrome browser extensions that change hands and the new owner then injects malware or crypto mining or keylogging etc. into the newly acquired extension.