3 ms·
echoing lalaland's comment, this diagram may give context about how changes to js libraries (incl hostile payloads, as in this example) flow through cdnjs: http
by shoo 5y ago
echoing lalaland's comment, this diagram may give context about how changes to js libraries (incl hostile payloads, as in this example) flow through cdnjs: https://blog.cloudflare.com/content/images/2019/12/1-with-arrow-v2-1.png https://blog.cloudflare.com/content/images/2019/12/1-with-ar...
from 2019/12/20 cloudflare blog post about cdnjs project: https://blog.cloudflare.com/an-update-on-cdnjs/ https://blog.cloudflare.com/an-update-on-cdnjs/
- jtsiskin 5y agobut this implies they own one of the repositories in https://cdnjs.com/libraries https://cdnjs.com/libraries?
- shoo 5y agoyes, that's my guess. there's 4051 of the things. or maybe there's another exploit to publish a bad version of someone else's package to npm that is already approved to have new versions mirrored by cdnjs robots ( i have no evidence that this was done in this case, but an attacker might be able to do it. there's a lot of surface area to attack in build & release pipeline of 4000+ packages )