4 ms·
Hmm they said that the malware came from a JS file called 'popper.js' and looking at their site it looks like they are using Bootstrap. Based on this sounds lik
by _fat_santa 4y ago
Hmm they said that the malware came from a JS file called 'popper.js' and looking at their site it looks like they are using Bootstrap. Based on this sounds like a supply chain attack.
- lockhouse 4y agoI’m honestly surprised this sort of thing doesn’t happen more often. One of the fastest ways to monetize an open source software package is to sell your GitHub login to a bad actor or put malware in it yourself. It would be extremely easy for a state level actor to compromise an npm dependency through bribery or blackmail.
- FezVrasta 4y agoPopper.js maintainer here, we haven't been compromised. They just injected the malware in that position but the malware didn't come from our npm release