Malicious code in the purescript NPM installer

Re:Malicious code in the purescript NPM installer by reeeeee on Monday July 29, 2019 @03:31AM (#20552253)

There is not even a link to the source code on the npm page for it. I installed it and inspected the source code, but I doubt everyone does this when installing a dependency.

[ Parent | on HN ]

Re:Malicious code in the purescript NPM installer by delfaras on Monday July 29, 2019 @03:43AM (#20552323)

Here's the complete source for anyone curious

``` exports = module.exports = trim;

function trim(str){ return str.replace(/^\s|\s$/g, ''); }

exports.left = function(str){ return str.replace(/^\s/, ''); };

exports.right = function(str){ return str.replace(/\s$/, ''); };

```

[ Parent | on HN ]

Re:Malicious code in the purescript NPM installer by rjmunro on Monday July 29, 2019 @06:49AM (#20553184)

That code doesn't match what actually happens. It will only trim a single character. Have asterisks been trimmed in your copy-paste or something?

[ Parent | on HN ]

Re:Malicious code in the purescript NPM installer by delfaras on Monday July 29, 2019 @07:35AM (#20553422)

Ah you're right, the asterisks have been interpreted as italics. Can't edit my comment, sorry

Here's a paste: https://pastebin.com/kBHprdyj

[ Parent | on HN ]