[jononor]

Can someone explain how the injection itself works? I assume it's the require doing the work, but its not so clear how that loads externally instead of from a path in filesystem?

[ekke]

NPM guys explain it in the blog today: https://news.ycombinator.com/item?id=16975025

[jononor]

Corrected URL to blogpost is: https://blog.npmjs.org/post/173526807575/reported-malicious-...

[dylz]

It appears to be middleware that looks at headers, and if a certain condition is met, it'll basically execute https://nodejs.org/api/vm.html#vm_vm_runinthiscontext_code_o... against whatever the header has.