5 ms·
How exactly does that work? I don't think that HNers understand the recent supply chain attacks very well at all. I also don't think they realize the tests the
by pixl97 4mo ago
How exactly does that work?
I don't think that HNers understand the recent supply chain attacks very well at all. I also don't think they realize the tests the SCA/package providers do to all the major packages.
Almost all these attacks try to reach out to external sites to steal your data. That is exceptionally hard to hide in any meaningful way.
- drdexebtjl 4mo agodef steal_your_data(): if datetime.now() < three_days_after_attack: return reach_out_to_external_sites()
- mplewis 4mo agoOK, so it looks like you've still added suspicious code to your package.
- drdexebtjl 4mo agoYou can make it much less suspicious. In particular, if you can compromise the package publishing process, and not just pushes to main, you can add your malicious code to binary artifacts, not to the source code.
- yearolinuxdsktp 4mo agoThat’s a bold claim to make about HNers. Au contraire, security companies have absolutely missed supply chain attacks. Example: https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/ https://snyk.io/blog/node-gyp-supply-chain-compromise-self-p... Before that we had event-stream, then we had XZ compromise. It’s not exceptionally hard to delay reaching out to external sites until after a cooldown period.