Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them

Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by dec0dedab0de on Monday April 13, 2026 @02:49PM (#47756319)

I was really saying that if there is a compromised version that gets removed from NPM, then the projects using it do not need to be updated, unless of course they had the compromised version pinned.

Though plenty of orgs centralize dependencies with something like artifactory, and run scans.

[ Parent | on HN ]

Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by bluGill on Monday April 13, 2026 @03:02PM (#47756478)

If someone detects it is asking a lot.

[ Parent | on HN ]