News for hackers. Stuff that matters.

A comment on Zed Editor automatically downloads binaries and NPM packages without consent. Parent comment

Re:Zed Editor automatically downloads binaries and NPM packa... by broeng on Monday July 08, 2024 @03:23AM (#40903299)
The xz backdoor was an example of exploiting this disconnect. It was not present in the repository, it was inserted only into the release artifacts. Anyone getting xz by checking out the repository and building it themselves, would not be affected by it.
[ Parent | on HN ]
Re:Zed Editor automatically downloads binaries and NPM packa... by nijave on Monday July 08, 2024 @07:24AM (#40904410)
I think that's a slight mischaracterization. It was present in the repo but obfuscated and rigged to only apply in release artifacts.

A sufficiently technical user could have found it but that bar was pretty high to clear.

[ Parent | on HN ]
Re:Zed Editor automatically downloads binaries and NPM packa... by broeng on Monday July 08, 2024 @08:45AM (#40904923)
I'm pretty sure that's incorrect. One portion of the build-to-host buildfile was only present in the release tarball.

https://www.openwall.com/lists/oss-security/2024/03/29/4

[ Parent | on HN ]
Re:Zed Editor automatically downloads binaries and NPM packa... by nijave on Tuesday July 09, 2024 @07:39AM (#40914910)
Right but it was injected from data in a "corrupt" xz file in the repo under certain conditions

>This injects an obfuscated script to be executed at the end of configure. This script is fairly obfuscated and data from "test" .xz files in the repository.

>The files containing the bulk of the exploit are in an obfuscated form in tests/files/bad-3-corrupt_lzma2.xz tests/files/good-large_compressed.lzma committed upstream

[ Parent | on HN ]