News for hackers. Stuff that matters.

A comment on ESLint compromised, may have stolen your credentials. Parent comment

Re:ESLint compromised, may have stolen your credentials by _bxg1 on Thursday July 12, 2018 @09:51AM (#17514519)
Maybe sandbox is the wrong technical term, but JS as a language runs with constraints. It can't manipulate pointers, mainly. As far as I know there's no such thing as a buffer-overflow attack in the context of Node.js.
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by fulafel on Thursday July 12, 2018 @10:02AM (#17514644)
If the malicious JS code is already running in node, there is no need to exploit a RCE bug.

edit: to expand, an underhanded js bug might be a path traversal bug, xss bug, leak of session cookies - any of the familiar js security bugs that occur as honest mistakes too.

(But while on the subject, Node API's are historically quite unsafe and do have lots of memory safety vulns, search results are in 3 digits in the issue tracker for queries like segfault. Node API's are not really written with hostile code in mind.)

[ Parent | on HN ]