6 ms·
I really want to know what would've happened with an npm install, I guess something boring like crypto mining or identity theft?
by rektomatic 3mo ago
I really want to know what would've happened with an npm install, I guess something boring like crypto mining or identity theft?
- gman2093 3mo agoArbitrary remote code execution, maybe sold to the highest bidder like some shady cloud provider?
- imankulov 3mo agoYou can actually test it yourself. The actual URL is in the post and the website is still up.
- mfkp 3mo agoSeems like it actually loads a PNG image now, maybe the npm script adds some additional headers to trigger the payload.
- flexagoon 3mo agoAFAIK most malware like this first sends the contents of your environment variables, ssh keys, passwords, etc. to the server, and then sets up a persistent process that executes arbitrary commands received from the attacker's server at any time, allowing them to run whatever else they want
- TurdF3rguson 3mo agoThis has happened to me, it was an attack that was trying to get crypto private keys (ethereum)
- phyzome 3mo agoCompromise of developer's access, API keys, etc. in order to create a supply chain attack.