News for hackers. Stuff that matters.

A comment on NPM Package Hijacking From the Hijacker's Perspective. Parent comment

Re:NPM Package Hijacking From the Hijacker's Perspective by troygoode on Friday March 25, 2016 @04:45PM (#11362560)
they'd notice as soon as they tried to run their program as "import * from 'lodash'" would fail (unless they were consistent with their typos...)
[ Parent | on HN ]
Re:NPM Package Hijacking From the Hijacker's Perspective by jtuchsen on Friday March 25, 2016 @04:53PM (#11362604)
You can inject a version of whatever you want into the node_modules folder in the post install script though can't you? So you just copy your own malicious lodash into node_modules. I haven't tried it but I think it'd work.
[ Parent | on HN ]
Re:NPM Package Hijacking From the Hijacker's Perspective by goldbeck on Friday March 25, 2016 @04:51PM (#11362594)
what if it ran "npm install -g lodash"?
[ Parent | on HN ]