3 ms·
Correct. These kinds of spam typosquatted packages are a feature of life on public packaging indexes, especially ones that have flat namespaces. It’s not ideal
by woodruffw 4y ago
Correct. These kinds of spam typosquatted packages are a feature of life on public packaging indexes, especially ones that have flat namespaces.
It’s not ideal, but it’s very far from a reasonable use of “0day” or an attack on an actual supply chain.
- oefrha 4y agoYou can typosquat on non-flat indices as well: org.apache.logging.log4j => org.apoche.logging.log4j, @babel/plugin-whatever => @babal/plugin-whatever, etc. I guess one argument against that is people are less likely to type the really long names by hand. Edit: And it’s harder to land on the typo you squatted in a longer name.
- wankle 4y agohttps://blog.sonatype.com/malware-removed-from-maven-central https://blog.sonatype.com/malware-removed-from-maven-central "Unlike most other open source software component ecosystems, Maven is built upon a strong namespacing concept that requires that every artifact be addressed using (minimally) a three part coordinate: Group ID : Artifact ID : Version. Group IDs follow the Java Package convention which is the reverse of a development team’s DNS. For example, all Apache Software Foundation artifacts have org.apache as the start of their Group ID. Org.apache.maven is Maven, org.apache.struts is Struts etc."