3 ms·
This is like the third one this week right? I know people keep saying about post-install should be opt out but then malware will just wait for first run instea
by madjam002 5y ago
This is like the third one this week right?
I know people keep saying about post-install should be opt out but then malware will just wait for first run instead.
How about an option to refuse to install any packages that have been published in the past week/2 weeks? That way hopefully malware like this would have been spotted before you end up running it locally.
- ant6n 5y agoIf everybody waits two weeks, then nobody will notice it on the first two weeks.
- dane-pgp 5y agoThe registry could send an email to the account which uploaded the package saying "Thank you for uploading version 1.2.3 of your-package." which would give them two weeks to think "Wait, I didn't upload a new version." Of course, if the attacker has access to their npm account, they can probably change the email address associated with the account too, so change-of-email requests should send a "Thank you for changing your email address" to the original address. The developer might have difficulty regaining control of the account, but hopefully they could inform the npm security team who could quite quickly confirm that a malicious package had been uploaded, which would be enough to get the malicious package taken down and the account locked.
- m4rtink 5y agoThey could also attack metadata parsers next - I don't think those are very hardened right now.