News for hackers. Stuff that matters.

A comment on Backdoor in event-stream library dependency. Parent comment

Re:Backdoor in event-stream library dependency by eropple on Monday November 26, 2018 @11:57AM (#18534700)
Good eyes, but this looks like it may be a red herring. That is a fork of the `scrypt` package, canonically found here:

https://www.npmjs.com/package/scrypt

With one maintainer, Barry Steyn, whose referenced repo is here:

https://github.com/barrysteyn/node-scrypt

Somebody would have to pick it up from a git URL, I think. (Maybe they could typosquat, but we'd have to find that first.)

[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by rdtsc on Monday November 26, 2018 @12:07PM (#18534805)
Yeah it looks mostly like a copy and saw most commits are not by that user, but the user has made some commits and not being familiar with how NPM packages work too well, thought I'd drop a warning here.
[ Parent | on HN ]