Supply chain attacks

May 10, 2022 · 11:14 AM UTC

9
93
22
307
Replying to @sniko_
Why does “foreach” even needs to be ever updated?
1
It doesn't 😅, but I bet there's projects setup with "foreach": "*" in their package.json
1
6
more replies
Replying to @sniko_
yarn why foreach
Replying to @sniko_
cool.... cool, cool, cool. :/
2
Replying to @sniko_
I believe you're looking for this:
https://mastodon.social/@lrvick @lrvick
9 May 2022
1. Buy expired NPM maintainer email domains. 2. Re-create maintainer emails 3. Take over packages 4. Submit legitimate security patches that include package.json version bumps to malicious dependency you pushed 5. Enjoy world domination.
5
Replying to @sniko_
We didn't have this problem so much on CPAN because we had a lot more people testing and checking modules for sanity.
Replying to @sniko_
This thing of the internet was probably a bad idea
2
Replying to @sniko_
Another day another JavaScript shenanigan
1