3 ms·
> Upload a package to PyPI or Node.js that emits specially crafted console output as part of its installer. If someone runs my installer without checking the c
by syzzer 6y ago
> Upload a package to PyPI or Node.js that emits specially crafted console output as part of its installer.
If someone runs my installer without checking the contents, why would I need UTF-8 bugs to get code executed?
(Not meant to downplay this bug, but the example made me wonder...)
- pengaru 6y agoThe host running the installer is often not the same as the one running the terminal emulator. Guess which is more likely to have keys to kingdoms?
- kstrauser 6y agoFair, so let’s skip the installation step and put the poison characters in its README so that `npm show hackerpackage` does the trick. Now installation isn’t necessary.