3 ms·
And it's not too rare, either. Tests of "supply chain attacks" have actually uploaded sample packages to package repos like NPM and PyPI, and the professional r
by sp332 6y ago
And it's not too rare, either. Tests of "supply chain attacks" have actually uploaded sample packages to package repos like NPM and PyPI, and the professional researchers collected bug bounties. Meanwhile the volunteer repo admins often take the blame and have to clean up all the fake packages too. https://arstechnica.com/information-technology/2021/02/supply-chain-attack-that-fooled-apple-and-microsoft-is-attracting-copycats/ https://arstechnica.com/information-technology/2021/02/suppl...
- angry_octet 6y agoThe difference is that the bug bounties are being collected from an endorsed bug bounty program. Fake and malicious packages jam public collections regularly, and are not part of white hat research. It's a trash fire which seemingly only gets better with exploits forcing people to change.
- sp332 6y agoThe bug bounties are from companies who use the repos, not the repos themselves.