Can you elaborate more about this? Why is it irrelevant in Western Europe?
640 karma · joined November 4, 2016
Thank you!
The package.json locked the file to ^1.3.2. If a newer version exists online that still satisfies the range in package.json (like 1.3.3 for ^1.3.2), npm install will often fetch that newer version and update your package-lock.json file automatically.
That’s how I understand it / that’s my current knowledge. Maybe there is someone here who can confirm/deny that. That would be great!
Kinda "proud" on it haha :D
It actually calculates the Levenshtein distance between the legitimate address and every address in its own list. It then selects the attacker's address that is visually most similar to the original one.
This is a brilliant piece of social engineering baked right into the code. It's designed to specifically defeat the common security habit of only checking the first and last few characters of an address before confirming a transaction.
We did a full deobfuscation of the payload and analyzed this specific function. Wrote up the details here for anyone interested: https://jdstaerk.substack.com/p/we-just-found-malicious-code...
Stay safe!
As for the “0 downloads” count: npm’s stats are not real-time. There’s usually a delay before download numbers update, and in some cases the beta UI shows incomplete data. Our pipeline picked up the malicious version because npm install resolved to it based on semver rules, even before the download stats reflected it. Running the build locally reproduced the same issue, which is how we detected it without necessarily incrementing the public counter immediately.
Have a great day!
Every tip is appreciated.
[1] https://www.amazon.com/Programming-Phoenix-1-3-Productive-Re...
Student-day (3 months in a row) [07:00] Wake up and get ready for university + drinking some coffee [08:15] First lesson starts [13:00] Lunch :) [13:30 - 14:00] Lunch ends & next lesson starts [16:45 - 17:30] Getting home [18:30] Dinner-time! [19:00 - 23:30 (or later)] Re-read university stuff, studying, ...
University-Phase is way more stressfull, because we have to finish a semester in 10-12 weeks, instead of 6 months. But I just don't want to miss the work-phase, I love it! Learning so much stuff each day while being a "regular" team member :)
And yeah, probably it isn't a blog as per definition, but a Wordpress blog seems like an easy and fast way to setup a little website w/ tutorials :)
In case somebody want's to give me feedback on my little blog, please do so: https://blog.jdstaerk.de