News for hackers. Stuff that matters.

A comment on Someone Bought 30 WordPress Plugins and Planted a Backdoor in All of Them. Parent comment

Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by Animats on Monday April 13, 2026 @03:34PM (#47756832)
Or worse

   sudo curl URL | bash
[ Parent | on HN ]
Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by chii on Monday April 13, 2026 @10:27PM (#47760545)
made even worse by the fact that it's possible to detect a pipe vs just standard out display of the contents of curl, from the server side.

This means the attack can be "invisible", as a cursory glance at the output of the curl can be misleading.

You _have_ to curl with piping the output into a file (like | cat), and examine that file to detect any anomaly.

[ Parent | on HN ]
Re:Someone Bought 30 WordPress Plugins and Planted a Backdoo... by boomlinde on Tuesday April 14, 2026 @01:25AM (#47761586)
> it's possible to detect a pipe vs just standard out display of the contents of curl, from the server side

That sounded really interesting, so I looked it up and found this article from 2016 if anyone else is interested: https://web.archive.org/web/20250622061208/https://www.idont...

[ Parent | on HN ]