3 ms·

I never typed in the full http link of a dependency by hand. Does anyone do that?

• lantry 4y ago
  Accidental typos aren't the only way this could be used. You could open a PR that contributes a new feature - all the code looks good, and the feature works as expected, but included in the PR is a new malicious dependency that uses deon.land instead of deno.land. That's an easy thing to miss when reviewing a large PR.
  • ravenstine 4y ago
    NPM can specify GitHub URLs as dependencies, so I don't see how this is a problem exclusive to Deno and not Node. Also, this problem can be mitigated by static analysis. No reason why a pre-push hook can't look at all the import identifiers and restrict them to a whitelist of domains. But having mentioned this before in another recent thread about Deno, some people are under the impression that statically analyzing imports is really hard, despite how even a junior engineer could figure it out with an AST parser in a day.
  • melvinmelih 4y ago
    First time I saw fontawesome being imported in a PR I had to double check to make sure fortawesome wasn't a typo. npm install @fortawesome/fontawesome-svg-core
• justsomehnguy 4y ago
  Nobpdy did. But where did you got that link from? With nginx and LE it quite trivial to have soemsite.tld to serve a valid content for somesite.tld, except the payload.
• hobofan 4y ago
  Typo attacks aren't just about typing the error by hand. They are often more about fooling human visual perception. E.g. for a more large-scale attack, you could replicate the whole deno.land/x/ website, which is where people often copy-paste the import snippet from. And as the sibling comment points out, typo-ed dependencies can also be introduced into existing codebases via a PR.