Malicious remote code execution backdoor discovered bootstrap-sass Ruby gem

Re:Malicious remote code execution backdoor discovered boots... by F117-DK on Thursday April 04, 2019 @05:27AM (#19570468)

This is scary. Gems don't have any audits?

[ Parent | on HN ]

Re:Malicious remote code execution backdoor discovered boots... by pmontra on Thursday April 04, 2019 @05:44AM (#19570534)

Not this kind of audits. Is there any major language for which all third party modules are audited for security before they are released? I would be surprised.

[ Parent | on HN ]

Re:Malicious remote code execution backdoor discovered boots... by raesene9 on Thursday April 04, 2019 @06:02AM (#19570597)

gems don't, NPM doesn't, PyPI doesn't, NuGet doesn't.... you get the picture.

Basically all apps using package repo's (i.e. all of them) are relying on massive piles of unaudited 3rd party code with usually no idea of provenance.

[ Parent | on HN ]