SolarWinds: What Hit Us Could Hit Others

Re:SolarWinds: What Hit Us Could Hit Others by twistedpair on Tuesday January 12, 2021 @05:39PM (#25754970)

Part of me wonders if they'd have been better with GitHub cloud CI/CD in Actions, with immutable build infra (e.g. Ubuntu base images).

But, with the wild npm dependency community, where a small app can have 5K transitive dependencies, I feel we're going to be even more susceptible to these attacks going forward.

[ Parent | on HN ]

Re:SolarWinds: What Hit Us Could Hit Others by f430 on Tuesday January 12, 2021 @06:27PM (#25755523)

One of the big reasons why some shops refuse to use Javascript on server side because of its unknown attack surface that is NPM.

It's impossible to keep track of all of these libraries that can be written by anyone. Someone could hijack a github account and push malicious code to NPM.

[ Parent | on HN ]