4 ms·
No, you read it right. I just misunderstood the post's message as "these exploits will enable more supply chain attacks". I'll probably delete my comment since
by CriticalRegion 5mo ago
No, you read it right. I just misunderstood the post's message as "these exploits will enable more supply chain attacks". I'll probably delete my comment since it's debating a strawman. It is absolutely right that these exploits might enable these attacks to have a larger impact. I still don't think that I agree with the message since a malicious npm package already installed can get its payloads from a C2 server, it doesn't need an npm update.
- Phelinofist 5mo ago> since a malicious npm package already installed can get its payloads from a C2 server, it doesn't need an npm update In general I agree, but I think these two vulns are 0day-y and pretty much every major distro is affected AFAIU, so there is perhaps slightly more potential than usual
- asqueella 5mo agoThanks for not deleting your question — I misunderstood the OP in the same way.