45 ms·

My layman's take is that it seems very similar to Log4j's vulnerability, but I don't really know for sure.

• oauea 5y ago
  Please explain why you think that, because it seems completely unrelated and off-topic.
  • moritonal 5y ago
    Bit harsh? Log4j was caused by a URL leading to bad code being imported. This let's you import code via a URL, seems quite similar?
    • sodality2 5y ago
      Log4j was caused when arbitrary log strings were interpreted as code imports. In this case the flag has to be manually set and the code manually added as a dependency.
    • anamexis 5y ago
      The Log4j vulnerability allowed unsafe user input to trigger loading of arbitrary code. Basically every dependency manager out there will allow you to load "bad code" from a URL.
      • tobyhinloopen 5y ago
        Log4j is no dependency manager
        • anamexis 5y ago
          No, it's not, but this new Node.js feature is for loading dependencies