this post was submitted on 05 Nov 2024
248 points (99.2% liked)

Technology

59669 readers
2684 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 16 points 3 weeks ago

I don't think that that's a counter to the specific attack described in the article:

The malicious packages have names that are similar to legitimate ones for the Puppeteer and Bignum.js code libraries and for various libraries for working with cryptocurrency.

That'd be a counter if you have some known-good version of a package and are worried about updates containing malicious software.

But in the described attack, they're not trying to push malicious software into legitimate packages. They're hoping that a dev will accidentally use the wrong package (which presumably is malicious from the get-go).