3 ms·
Malicious Postinstall Hook Found in 700 GitHub Repos, Including Node Projects
- gnabgib 5mo agoAll Composer packages (but the malicious part is in the node dependency) Effected* > Use effect as a noun to refer to a change resulting from something.
- tedchs 5mo agoHow many more examples of malware postinstall scripts do we need before Node quits running them by default, without warning?
- nullsex 5mo ago[dead]
- nullsex 5mo agoTitle is somewhat misleading. "Node projects" mean projects using nodejs as opposed to projects under the Node.js org.
- kspetkov79 5mo agoPostinstall hooks are a footgun. The bad part here is that people reviewing a PHP package may not even look closely at package.json.
- ryanshrott 5mo ago[flagged]