News for hackers. Stuff that matters.

A comment on ESLint compromised, may have stolen your credentials. Parent comment

Re:ESLint compromised, may have stolen your credentials by jpochtar on Thursday July 12, 2018 @01:19PM (#17516699)
Removing eval wouldn't help— you could always just write a tiny interpreter to do the same thing. This is a problem in any Turing complete programming language (with Reflection), although JS makes it easier.
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by Jupe on Thursday July 12, 2018 @01:34PM (#17516820)
True, it wouldn't solve the problem entirely, but I'd guess a 'tiny' interpreter would stand out more than a one liner like this one, possibly making detection easier.
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by RussianCow on Thursday July 12, 2018 @01:59PM (#17517065)
On the contrary, `eval` is used so little in real code that it's easy to detect. A tiny, obfuscated VM would be much more difficult.
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by mygo on Thursday July 12, 2018 @09:05PM (#17519835)
‘eval’ is not trivial to detect when it’s

window[rot13("riny")]("console.log('lol')");

or one of the many other ways to obfuscate eval

[ Parent | on HN ]