[a / b / c / d / e / f / g / gif / h / hr / k / m / o / p / s / t / u / v / vg / vm / vmg / vr / vrpg / vst / w / wg] [i / ic] [r9k / s4s / vip] [cm / hm / lgbt / y] [3 / aco / adv / an / bant / biz / cgl / ck / co / diy / fa / fit / gd / hc / his / int / jp / lit / mlp / mu / n / news / out / po / pol / pw / qst / sci / soc / sp / tg / toy / trv / tv / vp / vt / wsg / wsr / x / xs] [Settings] [Search] [Mobile] [Home]
Board
▼ Settings Mobile Home
/g/ - Technology
Return Catalog Bottom Refresh
Name
Options
Comment
Verification
4chan Pass users can bypass this verification. [Learn More] [Login]
File
  • Please read the Rules and FAQ before posting.
  • You may highlight syntax and preserve whitespace by using [code] tags.
08/21/20New boards added: /vrpg/, /vmg/, /vst/ and /vm/
05/04/17New trial board added: /bant/ - International/Random
10/04/16New board for 4chan Pass users: /vip/ - Very Important Posts
[Hide] [Show All]

Janitor acceptance emails will be sent out over the coming weeks. Make sure to check your spam folder!

[Advertise on 4chan]
[Return] [Catalog] [Bottom]
Anonymous
NPM supply chain attack No.109458879
File: file.png (552 KB, 1021x1183)
552 KB PNG
NPM supply chain attack  No.109458879
It's tuesday, so shai hulud is back and packages with ~2bn/mo installs have been compromised again

https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack
>>
Anonymous
 No.109459166
 No.109459166
File: 426939863.jpg (171 KB, 1024x576)
171 KB JPG
>>109458879
Update is the new security
>>
Anonymous
 No.109459513
 No.109459513
File: frodo.jpg (93 KB, 400x399)
93 KB JPG
Why don't they just have AI scanning each upload for malware?
>>
Anonymous
 No.109459528
 No.109459528
>>109458879
so I assume this is a nothing burger cause the "major organizations" they mention are literal whos. no large framework affected as it appears.
>>
Anonymous
 No.109459666
 No.109459666
UPDOOTERS BTFO ONCE AGAIN
>>
Anonymous
 No.109459720
 No.109459720
File: AI.png (1007 KB, 1294x713)
1007 KB PNG
>>109459513
It probably complex, the scripts are supposed to do many things and node developers are known run cross dependencies on a one liner projects to 100k line project
>>
Anonymous
 No.109459977
 No.109459977
In rust, this is just cargo add shai-hulud.
>>
Anonymous
 No.109462405
 No.109462405
File: 1700456116971015.jpg (21 KB, 645x364)
21 KB JPG
>>109458879
That's why i would never touch something as pozzed as node.js or Python.
>>
Anonymous
 No.109462411
 No.109462411
How many more times will this happen until they figure out a better way for distribution
>>
Anonymous
 No.109462865
 No.109462865
node trannies, not like this
not like this
>>
Anonymous
 No.109464442
 No.109464442
>>109458879
>Heh I'll call this shai hulud because that's dope, >hackerman and sci-fi. Just like me!
>>
Anonymous
 No.109464519
 No.109464519
How the fuck does anyone do anything serious with npm?
>>
Anonymous
 No.109464525
 No.109464525
>>109462411
It's a collaboration problem not a distribution problem.
>>
Anonymous
 No.109464538
 No.109464538
It's this easy:
0.0.0.0 registry.npmjs.org
0.0.0.0 npmjs.org
0.0.0.0 npmjs.com
0.0.0.0 npmjs.net
0.0.0.0 npm.im
0.0.0.0 yarnpkg.com
[Return] [Catalog] [Top]
Post a Reply
Return Catalog Top Refresh
[Advertise on 4chan]
Delete Post: [File Only] Style:
[Disable Mobile View / Use Desktop Site]

[Enable Mobile View / Use Mobile Site]

All trademarks and copyrights on this page are owned by their respective parties. Images uploaded are the responsibility of the Poster. Comments are owned by the Poster.