8 ms·
Lotusbail npm package found to be harvesting WhatsApp messages and contacts
- ChrisMarshallNY 10mo ago> the kind of dependency developers install without a second thought Kind of a terrifying statement, right there.
- agentifysh 10mo agoyeah i mean this is a tough problem. unless you work for a government contractor where they have strict security policies, most devs are just going to run npm install without a second thought as there are a lot of packages. i dont know what the solution here is other than stop using npm
- irishcoffee 10mo ago> unless you work for a government contractor where they have strict security policies ... So you're saying there is a blueprint for mitigating this already, and it just isn't followed?
- parliament32 10mo agoYes, but it requires people. Typically, you identify a package you want (or a new version of a package you want) and you send off a request to a separate security team. They analyze and approve, and the package becomes available in your internal package manager. But this means 1) you need that team of people to do that work, and 2) there's a lot of hurry-up-and-wait involved.
- irishcoffee 10mo ago> Yes, but it requires people. I've heard rumor of a few 100k people laid off in tech over the past few years that might be interested.
- ThunderSizzle 10mo agoWhose gonna pay for it? The companies that laid off those people? They'll just continue on without worrying.
- bigfatkitten 10mo agoDoesn't even require that many people. The analysis can mostly be automated, and the request process can be handled via peer review. Having one or two people for every 100-200 developers who can give sensible advice, provide some general oversight of what's going on, and step in to say 'no' occasionally does help though. Also means you can put an end to a popular antipattern that has grown in recent years: letting your production infrastructure talk to whatever it likes to download whatever it likes from the Internet.
- blincoln 10mo agoI'd be curious how many of today's automatic package validation tools or peer review processes would have caught the lotusbail package discussed in the article. The malicious aspects were heavily obfuscated, and it worked as advertised.
- kankerlijer 10mo agoIt's more work and more restrictive I suppose. Any business is free to set up jfrog Artifactory and only allow the installation of approved dependencies. And anyone can pull Ironbank images I believe.
- cxr 10mo agoEschewing with lockfile-based package management schemes actually takes less work. <https://news.ycombinator.com/item?id=46008744 https://news.ycombinator.com/item?id=46008744>
- miroljub 10mo agoThe issue with npm is JS doesn't have a stdlib, so developers need to rely on npm and third party libs even for things stdlib provide in languages like Java, Python, Go, ...
- Eduard 10mo agoJS has a stdlib, so to say. See nodejs, and Web standard. And no programming language's stdlib includes e. g. WhatsApp API libraries
- josephg 10mo agoSure it does. The JS standard library these days is huge. Its way bigger than C, Zig and Rust. It includes: - Random numbers - Timezones, date formatting - JSON parsing & serialization - Functional programming tools (map, filter, reduce, Object.fromEntries, etc) - TypedArrays And if you use bun or nodejs, you also have out of the box access to an HTTP server, filesystem APIs, gzip, TLS and more. And if you're working in a browser, almost everything in jquery has since been pulled into the browser too. Eg, document.querySelector. Of course, web frameworks like react aren't part of the standard library in JS. Nor should they be. What more do you want JS to include by default? What do java, python and go have in their standard libraries that JS is missing?
- krapp 10mo agoWhen people say "js doesn't have a stdlib" they mean "js doesn't have a robust general purpose stdlib like C++ or ${LANGUAGE_ID_RATHER_BE_USING}." But of course it fucking doesn't because it's a scripting language for the web. It has what it needs, and to do that it doesn't need much.
- josephg 10mo ago> When people say "js doesn't have a stdlib" they mean "js doesn't have a robust general purpose stdlib like C++ ... It does though! The JS stdlib even includes an entire wasm runtime. Its huge! Seriously. I can barely think of any features in the C++ stdlib that are missing from JS. There's a couple - like JS is missing std::priority_queue. But JS has soooo much stuff that C++ is missing. Its insane.
- josephg 10mo ago> i dont know what the solution here is other than stop using npm Personally I think we need to start adding capability based systems into our programming languages. Random code shouldn't have "ambient authority" to just do anything on my computer with the same privileges as me. Like, if a function has this signature: function add(a: int, b: int) -> int Then it should only be able to read its input, and return any integer it wants. But it shouldn't get ambient authority to access anything else on my computer. No network access. No filesystem. Nothing. Philosophically, I kind of think of it like function arguments and globals. If I call a function foo(someobj), then function foo is explicitly given access to someobj. And it also has access to any globals in my program. But we generally consider globals to be smelly. Passing data explicitly is better. But the whole filesystem is essentially available as a global that any function, anywhere, can access. With full user permissions. I say no. I want languages where the filesystem itself (or a subset of it) can be passed as an argument. And if a function doesn't get passed a filesystem, it can't access a filesystem. If a function isn't passed a network socket, it can't just create one out of nothing. I don't think it would be that onerous. The main function would get passed "the whole operating system" in a sense - like the filesystem and so on. And then it can pass files and sockets and whatnot to functions that need access to that stuff. If we build something like that, we should be able to build something like npm but where you don't need to trust the developers of 3rd party software so much. The current system of trusting everyone with everything is insane.
- irishcoffee 10mo ago> No network access. No filesystem. Nothing. Ironically, any c++ app I've written on windows does exactly this. "Are you sure you want to allow this program to access networking?" At least the first time I run it. I also rarely write/run code for windows.
- christophilus 10mo agoYeah, but if that app was built using a malicious dependency that only relied on the same permissions the app already uses, you’d just click “Yes” and move on and be pwned.
- ____tom____ 10mo agoDeveloping in a container might mitigate a lot of issues. Harder to compromise your development machine. I guess if you ship it you are still passing along contagion
- sneak 10mo agoEvery docker image specified in a k8s yml or docker-compose file or github action that doesn’t end in :sha256@<hash> (ie specifying a label) is one “docker push” away from a compromise, given that tags/labels are not cryptographically specified. You’re just trusting DockerHub and the publisher (or anyone with their creds) to not rug you. The industry runs on a lot more unexamined trust than people think. They’re deployed automatically by machine, which definitionally can’t even give it a second thought. The upstream trust is literally specified in code, to be reused constantly automatically. You could get owned in your sleep without doing anything just because a publisher got phished one day.
- OptionOfT 10mo agoPinning a GitHub Actions action doesn't prevent the action itself from doing an apt install, npm install or running a Docker image that is not pinned.
- ChrisMarshallNY 10mo agoThat's one reason I barely use any dependencies. I'm forced to use a couple, but I tend to "roll my own," quite a bit. Well, I should qualify that. I do use quite a few dependencies, but they are ones that I wrote.
- embedding-shape 10mo agoRequiring the use of lockfiles and strict adherence to checking updates, also helps. I tend to use dependencies for many things, but ones I've trusted over a long time, I know how they work, often chosen because of how they were implemented, so I can see the updates and review them myself. Scaling up to a team, you make that part of the process whenever you add a new dependencies, and someone's name always have to be "assigned" to a dependency, so people take ownership of the code that gets added. Often people figure out it's not worth it, and figure out a simpler way.
- ChrisMarshallNY 10mo agoThat sounds like a great policy.
- sublinear 10mo agoIt's also hyperbole
- josephg 10mo agoI've worked in plenty of javascript shops and unfortunately its not so far off the mark. Its quite common to see JS projects with thousands of transitive dependencies. I've seen the same in python too.
- morshu9001 10mo agoIt's funny how Py has less of this reputation just because the package manager is so broken that you might have a hard time adding so many deps in the first place. (Maybe fixed with uv, but that's relatively new and not default.)
- ChrisMarshallNY 10mo agoI'm not so sure about that. I've watched developers judge dependencies by GH stars, and "shiny" quotient. On a completely unrelated tangent, I remember reading about a "GH Stars as a Service" outfit. I don't see any way that could be abused, though.../s
- pixl97 10mo agoUntil you start doing SBOM and seeing what developers are pulling out in the field.
- btbuildem 10mo agoIt's terrifying because it's true for a majority of developers.
- runningmike 10mo agoPopularity is never a metric for security or quality….Always verify.
- k8sToGo 10mo agoBut... GitHub stars!
- criddell 10mo agoVerify? Verify what?
- user34283 10mo agoVerify what? I certainly don't have the capacity to thoroughly review my every dependency's source code in order to detect potentially hidden malware. In this case more realistic advice would probably be to either rely on a more popular package to benefit from swarm intelligence, or creating your own implementation.
- bdangubic 10mo agoalso scrutinize every dependency you introduce. I have seen sooooo many dependencies over the years where a library was brought in for one or two things which you can write yourself in 5 minutes (e.g. commons-lang to use null-safe string compare or contains only)
- notKilgoreTrout 10mo agoSure but you basically need a different ecosystem to bring in a popular package and not expect to end up with these trivial libraries indirectly through some of the dependencies.
- user34283 10mo agoSaid scrutinizing from my side consists of checking the number of downloads and age of the package, maybe at best a quick look at the GitHub. Yes, I'm sure many dependencies aren't very necessary. However, in many projects I worked on (corporate) which were on the older Webpack/Babel/Jest stack, you can expect node_modules at over 1 GB. There this ship has sailed long ago. But on the upside, most of those packages should be fairly popular. With pnpm's dependency cooldown and whitelisting of postinstall scripts, you are probably good.
- fooker 10mo ago> 56k Downloads? That seems ..low..?
- Eji1700 10mo agoIt also seems weird that people are only scanning code that breaks? I have 0 cred in anything security, so maybe i'm just missing a bigger picture thing, but like...if you told me i had to make some sort of malicious NPM package and get people to use it, i'd probably just find something that works, copy the code, put in some stylistic changes, and then bury my malicious code in there? This seems so obvious that I question if the OP is correct in stating people aren't looking for that, or maybe I misunderstand what they mean because i'm ignorant?
- pixl97 10mo ago>It also seems weird that people are only scanning code that breaks? That's how the xz exploit was caught.
- outofpaper 10mo agoFeels almost SEO. 56k used to be the top speed for models. It was L33t.
- deleted 10mo ago[deleted]
- peacebeard 10mo agoWow that AI art looks terrible.
- ilio 10mo agoLots of signs of AI writing also: “not this, but that” constructions everywhere. The first paragraph in Final Thoughts is pure ChatGPT. It’s hard to read any blog anymore without trying to work out which part is actually from a human.
- canyp 10mo agoSoon the only way to assure your readers that your writing is human is by calling them a motherfucker in the opening sentence. But then, you'd only be sure that the first sentence was legitimate and not the rest of the article. That is why I constantly reassure my readers that they're some goddamn motherfuckers throughout my writing. And you, too, are one, my friend.
- peacebeard 10mo agoWe’ve got a bonified human right here motherfuckers
- BubbleRings 10mo agoSo is there a list of the most popular apps that made use of the infected lotusbail npm package?
- baobun 10mo agoNPM show 0 dependents in public packages. The 56k downloads number can easily have been be gamed by automation and therefore not a reliable signal of popularity.
- montague27 10mo agoIs there an increasing trend of supply chain attacks? What can developers do to mitigate the impact?
- HighGoldstein 10mo agoMitigate? Stop using random packages. Prevent? Stop using NPM and similar package ecosystems altogether.
- metaltyphoon 10mo ago> and similar package ecosystems altogether Realistically, this is impossible.
- baq 10mo agoat some point having LLMs spit out libraries for you might be safer than actually downloading them.
- Eduard 10mo agoLLMs will happily copy-paste malware or add them as dependencies
- morshu9001 10mo agoThis does help. Even before, I was pretty careful about what I used, not just for security but also simplicity. Nowadays it's even easier to LLM-generate utils that one might've installed a dep for in the past.
- Muromec 10mo agothis kicks the can down the road until we get supply chain attacks through LLM poisoning, like we already do with propaganda
- christophilus 10mo ago
- deleted 10mo ago[deleted]
- cxr 10mo agoAt this point, the existence of these attacks should be an expected outcome. (It should have been expected even without the empirical record we now have and the multiple times that we can now cite.) NPM and NPM-style package managers that are designed to late-fetch dependencies just before build-time are already fundamentally broken. They're an end-run around the underlying version control system, all in favor of an ill-considered, half-baked scheme to implement an alternative approach to version control of the package manager project maintainers' devising. And they provide cover for attacks like this, because they encourage a culture where, because one's dependencies are all "over there", the massive surface area gets swept under the rug and they never get reviewed (because 56K NPM users can't be wrong).
- montroser 10mo agoI agree with much of what you said here, but is it really just about the package manager? If I had specified this repo's git url with a specific version number or sha directly in my package.json, the outcome would be just about the same. And so that's not really an end-run around version control at that point. Even with npm out of the picture the problem is still there.
- Gigachad 10mo agoThe root problem is the OS allows npm packages to grab your WhatsApp messages without the user knowing.
- wincy 10mo agoThis is an npm package that allows you to interact with WhatsApp using their API. The OS wouldn’t prevent this as it’s not interacting with your WhatsApp on your machine, but rather logging you in via a skillfully made 3rd party interface, that unfortunately happens to also be evil.
- mrweasel 10mo agoThe OS isn't allowing anything as far as I can see. It's a fork of a library that allows you to use the WhatsApp API, it actually works, it also just happen to also harvest your credentials and messages. Should the OS prevent you from doing API calls to WhatsApps servers? What about the actual library this is based on, should that be blocked as well? The root of the problem is that users and developers may have legitimate reasons to want API access to a service, like WhatsApp. That just comes with a level of risk. Especially in a world where we're not use to auditing our dependencies. The only sort of maybe solution I can see is the operating system prompting you when an application want's to make an outgoing request, but in this case the messages might just go to AWS and an S3 bucket, or it could send them via WhatsApp to the attack, how would you spot that in the operating system, without built in knowledge of WhatsApp specifically?
- agentifysh 10mo agowonder if this is possible with flutter packages or python? im looking to slowly get away from javascript ecosystem. ive started using Flutter even for web applications as well, works pretty well, still use Astro/React tho for frontend websites so I can't completely get away from it.
- paularmstrong 10mo agoThe code is literally right there for you. It doesn't matter what ecosystem or package manager. Someone could distribute the same thing anywhere — it's up to those pulling it in to actually start auditing what they're accepting.
- johnny22 10mo agoyes it is possible with rust, python, php, and likely many others
- deleted 10mo ago[deleted]
- The_President 10mo agoPyPI has had compromised or fake packages in the past.
- esafak 10mo agoDid any other scanner catch this, and when? A detection lag leaderboard would be neat.
- rglover 10mo agoMicrosoft either needs to become a better steward of NPM or hand it off to a foundation that can properly maintain it.
- The_President 10mo agoGood plan - I'm sure they'll get right on it after solving the virus and malware issues on their mainline OS.
- Aeolun 10mo agoThey’ve only had like 30 years. You need to give them some time!
- anonzzzies 10mo agoIf they really believe their AI is that good and security practices and tooling that solid, why can't they automatically flag this stuff? I am sure they can, but once flagged a human has to check and that seems costly?
- ashishb 10mo agoJavaScript fanatics will downvote me, but I will say again. JavaScript is meant to be run in an untrusted environment (think browser), and running it in any form of trusted environment increases the risk drastically [1] The language is too hard to do a meaningful static analysis. This particular attack is much harder (though not impossible) to execute in Java, Go, or Rust-based packages. 1 - https://ashishb.net/tech/javascript/ https://ashishb.net/tech/javascript/
- tantalor 10mo agoEven in a browser, a compromised JS payload can put your user's data and privacy at risk.
- ashishb 10mo ago> Even in a browser, a compromised JS payload can put your user's data and privacy at risk. True. In a backend, however, a compromised payload can put all of user's and your non-user data at risk.
- Muromec 10mo ago> your non-user data at risk. That sounds like a GDPR fine waiting to be issued right there.
- mcintyre1994 10mo agoIn what way is it harder to write a library that exfiltrates credentials passed to it in those languages? I’d think it’d be a bit easier because you could use the standard library instead of custom encryption, but otherwise pretty much the same.
- ashishb 10mo ago> In what way is it harder to write a library that exfiltrates credentials passed to it in those languages? It is not harder to write. It is more challenging to execute this attack stealthily. Due to the myriad behaviors of runtimes (browser vs. backend), frameworks (and their numerous versions), and over-dependency on external dependencies (e.g., leftpad), the risk in JS-based backends increases significantly.
- evdubs 10mo agoIs there no Apache Commons for Javascript? It'd be nice to have a large library from a 'trusted' group. https://en.wikipedia.org/wiki/Apache_Commons https://en.wikipedia.org/wiki/Apache_Commons
- schneehertz 10mo agoNo matter how large the library, it won't include WhatsApp's API
- deleted 10mo ago[deleted]
- The_President 10mo agoRecently audited a software plan created by an AI tool. NPM dependencies as far as the eye can see. I can only imagine the daunting liability concerns if the suggested "engineering" style was actually put forth to be used in production across the wide userbase. That said, the process of the user creating the "draft" codebase gave them a better understanding of scope of work necessary.
- tekacs 10mo agoJust to talk about a different direction here for a second: Something that I find to be a frustrating side effect of malware issues like this is that it seems to result in well-intentioned security teams locking down the data in apps. The justification is quite plausible -- in this case WhatsApp messages were being stolen! But the thing is... that if this isn't what they steal they'll steal something else. Meanwhile locking down those apps so the only apps with a certain signature can read from your WhatsApp means that if you want to back up your messages or read them for any legitimate purpose you're now SOL, or reliant on a usually slow, non-automatable UI-only flow. I'm glad that modern computers are more secure than they have been, but I think that defense in depth by locking down everything and creating more silos is a problem of its own.
- vlovich123 10mo agoThe OS should be mediating such access where it explicitly asks your permission for an app to access data belonging to another publisher.
- bhhaskin 10mo agoThis sounds great on paper, but what happens when the OS isn't working for the user like Windows?
- hamandcheese 10mo agoSwitch OS.
- pixl97 10mo agoI mean this was an app for accessing WhatsApp data, you would approve it and go on... the problem is with it sending data off to a 3rd party.
- bhhaskin 10mo agoI think you miss understood. If the OS becomes the arbiter of what can and cannot be accessed; it's a slippery slope to the OS becoming a walled garden that only approved apps and developers are allowed to operate. Of course that is a pretty large generalization, but we already see it with mobile devices and are starting to see it with windows and Mac OS. I don't think we should be handing more power to OS makers and away from users. There has to be a middle ground between wall gardens and open systems. It would be much better for node & npm to come up with a solution than locking down access.
- anonzzzies 10mo agoI had some dependency of a dependency installing crypto miners: it was pretty scary as we have not had this since wordpress. I saw a lot more people having this issue (there is a weird process consuming all my cpu). Like someone here already says: we need an Apache / NPM commons and when packages use anything outside those, big fat alarm bells should chime.
- no-name-here 10mo agoAs others pointed out elsewhere, that wouldn’t have helped in this case as presumably it wouldn’t include a WhatsApp API, the purpose of this package. But it could help in general, sure.
- deleted 10mo ago[deleted]
- deleted 10mo ago[deleted]
- deleted 10mo ago[deleted]
- edoceo 10mo agoOnce again, just having a better supply chain tool, just reviewing the changed packages could mitigate. Maybe hold back some of the dependencies of dependencies would mitigate. Why aren't more teams putting some tool in-front of their blind-installs from NPM (et al)
- antiloper 10mo agoWas anyone actually affected by this? Is this package a dependency of some popular package? I assume the answer is no because this is clearly clickbait AI slop but who knows.
- llmslave2 10mo agoIf one relies on the JS ecosystem to put food on the table and can't realistically make changes at their job to mitigate this, short of developing on a second airgapped work-only computer what can developers do to at least partially mitigate the risk? I've heard others mention doing all development in docker containers. Perhaps using a Linux VM?
- morshu9001 10mo agoIf you're distributing something that uses this package, it's not just your dev computer at risk, it's all the users.
- llmslave2 10mo agoI'm aware thanks, but if your company is doing the standard practice of using 10k dependencies for some JS webslop you don't really have any other options but to protect yourself.
- ryanto 10mo agoI run incus os, which is an operating system that is made for spinning up containers and VMs. Whenever I have to work on a JS project I launch a new container for development and then ssh into it from my laptop. You can also run incus on your computer without installing it as an operating system. Containers still have some risk since they share the host kernel, but they're a pretty good choice for protection against the types of attacks we see in the JS ecosystem. I'll switch to VM's when we start seeing container escape exploits being published as npm packages :) When I first started doing development this way it felt like I was being a bit too paranoid, but honestly it's so fast and easy it's not at all noticeable. I often have to work on projects that use outdated package managers and have hundreds of top-level dependencies, so it's worth the setup in my opinion.
- llmslave2 10mo agoAmazing suggestion. So you're running it inside a Docker container or something? I'm going to try this out. I guess the alternative is a VPS if all else fails.
- cromka 10mo agoI am seriously surprised developers trust NodeJS to this extend and aren't afraid of being sued for inadvertently shipping malware to people. It's got to be a matter of time, doesn't it, before some software company gets in serious trouble because of that. Or, NPM actually implements some serious stewardship process in place.
- paularmstrong 10mo agoThis has nothing to do with NodeJS or NPM. The code is freely distributed, just like any open source repo or package manager may provide. The onus is on those who use it to audit what it actually does.
- cromka 10mo agoIt absolutely does have to do with it. If we continued to ship software libraries like we still do on Linux, then you wouldn't be downloading its releases straight from the source repo, but rather have someone package and maintain them. Except at the granularity of NodeJS packages, it would be nearly impossible to do.
- Kwpolska 10mo agoWhy are Linux packagers so trustworthy? In most distros, they're a group of volunteers. The group is smaller, but it's not impossible for someone with malicious intent to get the keys to the kingdom and upload packages with embedded malware.
- Eduard 10mo agoas of this writing, the alleged malware/project is still available on npm and GitHub. I'm surprised koi.ai does not mention in their article if they have reported their findings to npm/GitHub.
- e12e 10mo ago> The lotusbail npm package presents itself as a WhatsApp Web API library - a fork of the legitimate @whiskeysockets/baileys package. > The package has been available on npm for 6 months and is still live at the time of writing. > (...) malware that steals your WhatsApp credentials, intercepts every message, harvests your contacts, installs a persistent backdoor, and encrypts everything before sending it to the threat actor's server.
- jameslk 10mo agoMalicious libraries will drive more code to be written by LLMs. Currently, malicious libraries seem to be typically trivial libraries. A WhatsApp API library is just on the edge of something that can be vibe coded, and avoiding getting pwned may be a good enough tipping point to embrace NIH syndrome more and more, which I think would be a net negative for F/OSS The incentives are aligned with the AI models companies, which benefit from using more tokens to code something from scratch Security issues will simply move to LLM related security holes
- Kwpolska 10mo agoThe library in question is a malicious fork of a library which reverse engineered the undocumented WhatsApp Web API. Good luck making a slop generator reverse engineer an API.
- jameslk 10mo agoI would wager LLMs in a good enough tool/eval loop would actually do pretty well at that task. But they may also be pretty good at just replicating existing libraries wholesale, sans the malicious bits
- scotty79 10mo ago> Traditional security doesn't catch this. > const backdoorCode = crypto.AES.decrypt( "U2FsdGVkX1+LgFmBqo3Wg0zTlHXoebkTRtjmU0cq9Fs=", "ERROR_FILE" ).toString(crypto.enc.Utf8); Really? Isn't random garbage string pretty strong indication of someone doing something suspicious?
- pixl97 10mo agoI mean there are a number of tools that look for things like high entropy strings and other crypto keys.
- j45 10mo agoAlmost need to run each npm package isolated to the extent possible, or something equivalent.
- paul_h 10mo agoisolated-vm (https://www.npmjs.com/package/isolated-vm https://www.npmjs.com/package/isolated-vm) here we come for increased sandboxing of node bits and pieces? And we are a year after Java took out the security manager that could sandbox jars in separate classloaders - a standout feature since 1995.
- throw-12-16 10mo agoNPM was a mistake. We created a minefield of abandonware and called it an ecosystem.
- SoftTalker 10mo agoOr perhaps it was all by design?
- gloxkiqcza 10mo agoUsing this package is a security failure from the beginning. It doesn’t use the public WhatsApp API, it reimplements the official WhatsApp client auth. Authentication uses a shared secret and it’s obvious that you as a third party obtaining this secret from your users is unsafe and a bad practice (especially if it’s third party code processing it!). Users should know better as well but you can’t really blame them.
- WA 10mo ago> It doesn’t use the public WhatsApp API, it reimplements the official WhatsApp client auth. Nothing wrong with that if the official API has less features. > Authentication uses a shared secret and it’s obvious that you as a third party obtaining this secret from your users What do you mean? Usually, you install such a package to automate WhatsApp for your own account.
- Proofread0592 10mo ago> public WhatsApp API There is no public WhatsApp API. You need to sign up for "WhatsApp Business Platform" to be able to use an API to interact with WhatsApp. If there was a real API for WhatsApp, this probably wouldn't have happened.
- cogogo 10mo agoI know I shouldn’t but I find it hilarious that whoever wrote this wrote the malware so explicitly. Something about functions like exfiltrateCredentials and clear comments for the backdoor makes me chuckle. They went through all the trouble to detect debuggers and sandboxes and did not even bother to obfuscate the code.
- cogogo 10mo agoIt also has me musing… do they have good test coverage for their 27 debugging traps? And it must be such a headache to even functionally test your malware. What a time to be alive!
- taherm789 10mo agoIt's not? The code is all obfuscated, the author wrote it for us to demonstrate what's happening.
- Etheryte 10mo agoThe author specifically calls it out in the post, no? > They also left helpful comments in their code marking the malicious sections - professional development practices applied to supply chain attacks. Someone probably has a Jira board for this.
- slhck 10mo agoThese LLM-generated blogs aren't going away – they're everywhere. And the best part? You can now instantly push out garbage content at no cost. Traditional writing is not just dead. It's legacy. The real marketer doesn't care. He just slops.
- imperfectfourth 10mo agoit's funny that your comment also feels very LLM-generated.
- slhck 10mo agoUm, yes. That's the entire joke.