3 ms·
>npm install playcaptcha Imagine you get pwned for trying this out in your home project and the APT escalates to your company repos and infects your company as
by TZubiri 5mo ago
>npm install playcaptcha
Imagine you get pwned for trying this out in your home project and the APT escalates to your company repos and infects your company assets, and then the post mortem comes in and you have to explain this is what infected the company it stack
- GuestFAUniverse 5mo agonpm install randomgotcha
- Terr_ 5mo ago> npm install Coworkers on project: "Containers? Not running things as root? Hah, you're overengineering things: Just follow the readme where it says to install the daemons and run all code and plugins on your dev-box. It works fine, then we can show how we're using AI!" (Yeah, not as good as completely separate computer, diminishing returns, but still...)
- thunderbong 5mo agoIf you see the code, that dependency just happens to be another file in the repository [0] The only dependency is the 'motion' library. [0]: https://github.com/mortspace/playcaptcha https://github.com/mortspace/playcaptcha
- TZubiri 5mo agodoes npm install pull code from that github repo, though? If not, auditing that repo is a huge blunder. I'm seeing this from npm, which is a bit different: https://www.npmjs.com/package/playcaptcha https://www.npmjs.com/package/playcaptcha Not saying the package is malicious, (although it might be, but it's a more likely threat that the devs themselves become infected by a supply chain worm and spread it downstream.) just saying, if you are going to audit it, actually audit it as if you were up against an attacker.