4 ms·
but this implies they own one of the repositories in https://cdnjs.com/libraries https://cdnjs.com/libraries?
by jtsiskin 5y ago
but this implies they own one of the repositories in https://cdnjs.com/libraries https://cdnjs.com/libraries?
- shoo 5y agoyes, that's my guess. there's 4051 of the things. or maybe there's another exploit to publish a bad version of someone else's package to npm that is already approved to have new versions mirrored by cdnjs robots ( i have no evidence that this was done in this case, but an attacker might be able to do it. there's a lot of surface area to attack in build & release pipeline of 4000+ packages )