2 ms·
Did you read the article? This attack was not about naming malicious packages similar to legit ones or common typos of them. > A large number of corrupted pack
by Etheryte 4y ago
Did you read the article? This attack was not about naming malicious packages similar to legit ones or common typos of them.
> A large number of corrupted packages use names related to game cheats, free resources, and social media platforms, such as "free-tiktok-followers" and "free-xbox-codes," to entice users to click the links and direct them to multiple well-designed phishing webpages.
- duskwuff 4y agoThose honestly sound like they're just using NPM as a platform to host their spam. All the spammers care about is that they get to host their content on a trusted domain with a keyword-dense URL; there's no expectation that anyone actually install the package. The same problem exists on Docker Hub, e.g. https://hub.docker.com/r/neyprivedpu1972/windows-7-7264-download-iso-torrent https://hub.docker.com/r/neyprivedpu1972/windows-7-7264-down...