News for hackers. Stuff that matters.

A comment on Backdoor in event-stream library dependency.

Re:Backdoor in event-stream library dependency by jrochkind1 on Monday November 26, 2018 @01:32PM (#18535645)
it's kind of impressive this compromise was discovered _at all_. Anyone know the story of how it was? There seems to be a lot of back story before the linked issue begins.

I'm interested in who noticed the compromise, when, and how. Because with open source, noticing the compromise is about the _best_ we can expect from a "worst case".

[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by igolden on Monday November 26, 2018 @05:22PM (#18537388)
A random, lucky find: https://github.com/remy/nodemon/issues/1442
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by jrochkind1 on Monday November 26, 2018 @06:15PM (#18537722)
Interesting. If the malware hadn't buggily triggered a deprecation warning...
[ Parent | on HN ]
Re:Backdoor in event-stream library dependency by gnulinux on Monday November 26, 2018 @07:38PM (#18538236)
Makes you think how many backdoors out there like this.
[ Parent | on HN ]