4 ms·
Fake Developer Jobs Laced with Malware
- deleted 3y ago[deleted]
- pcloadletter_ 3y agoSounds like the attacker is getting pretty smart about this stuff too. They have a self-hosted registry with the offending package so it can't get yanked from the actual npm registry >The attackers now host the attack from mave-finance/next-assessment. The malicious dependency is json-mock-config-server which is not listed in the npm registry, but rather is served from npm.mave.finance as before, the registry listed in .npmrc.