News for hackers. Stuff that matters.

A comment on Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them. Parent comment

Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by dec0dedab0de on Monday April 13, 2026 @02:26PM (#47756027)
The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

This is the best reason for letting users install from npm directly instead of bundling dependencies with the project.

[ Parent | on HN ]
Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by bluGill on Monday April 13, 2026 @02:32PM (#47756114)
What user is going to check dependencies like that?
[ Parent | on HN ]
Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by dec0dedab0de on Monday April 13, 2026 @02:49PM (#47756319)
I was really saying that if there is a compromised version that gets removed from NPM, then the projects using it do not need to be updated, unless of course they had the compromised version pinned.

Though plenty of orgs centralize dependencies with something like artifactory, and run scans.

[ Parent | on HN ]
Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by bluGill on Monday April 13, 2026 @03:02PM (#47756478)
If someone detects it is asking a lot.
[ Parent | on HN ]
Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by kibwen on Monday April 13, 2026 @03:02PM (#47756480)
Users who don't care about security are screwed no matter what you do. The best you can do is empower those users who do care about security.
[ Parent | on HN ]
Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by bluGill on Monday April 13, 2026 @04:42PM (#47757554)
That cannot work. Nor should it work. However can we make things so that users don't need to care in the first place?

Note that the above probably isn't 100% answerable. However it needs to be the goal. A few people need to care and take care of this for everyone. Few needs to be a large enough to not get overwhelmed by the side of the job.

[ Parent | on HN ]