2 ms·

It's not white hat because they actively extract data; if it was just to prove it worked they could've done a console.log, cause npm install to fail, or not ext

It's not white hat because they actively extract data; if it was just to prove it worked they could've done a console.log, cause npm install to fail, or not extract a payload.

that_guy_iain 2y ago
The data they extract is nothing sensitive and this way they can see how many hits they get. The more affected the bigger the headline for them.
- __jonas 2y ago
  In what world is "all environment variables" nothing sensitive?
  - guappa 2y ago
    Even just the username is sensitive because it gives hint on what to try with ssh attempts.