tanepiper/steal-ur-stuff

Steal Ur Stuff

3 mentions on Hacker News by 1 person: 0 stories, 3 comments · first 2017-07-13 · latest 2023-06-27

Mentions per year 3 mentions · busiest year 2017 (1)

20082026

All Stories Comments Newest Top Oldest

I actually did a POC 7 years ago about this - https://github.com/tanepiper/steal-ur-stuff It was reported to npm at the time, but they chose to ignore it - https://github.com/npm/npm/issues/17724
comment by tanepiper · 2023-06-27 · in JavaScript registry NPM vulnerable to 'manifest confusion' abuse
…[2] https://medium.com/@maybekatz/introducing-npx-an-npm-package... [3] https://github.com/tanepiper/steal-ur-stuff
comment by tanepiper · 2020-12-26 · in Getting rid of NPM scripts
…Gist. This set alarms off for me as a potential security attack vector. I raised the issue with a ( https://github.com/tanepiper/steal-ur-stuff ) that showed - a module with no dependencies, but a post-install script running npx to grab…
comment by tanepiper · 2017-07-13 · in Npm-lint – An opinionated checker for your npm package