Hacker News new | ask | show | jobs
by TZubiri 10 days ago
>npm install playcaptcha

Imagine you get pwned for trying this out in your home project and the APT escalates to your company repos and infects your company assets, and then the post mortem comes in and you have to explain this is what infected the company it stack
3 comments
Terr_ 10 days ago
> npm install

Coworkers on project: "Containers? Not running things as root? Hah, you're overengineering things: Just follow the readme where it says to install the daemons and run all code and plugins on your dev-box. It works fine, then we can show how we're using AI!"

(Yeah, not as good as completely separate computer, diminishing returns, but still...)

link
thunderbong 10 days ago
If you see the code, that dependency just happens to be another file in the repository [0]

The only dependency is the 'motion' library.

[0]: https://github.com/mortspace/playcaptcha

link
TZubiri 10 days ago
does npm install pull code from that github repo, though? If not, auditing that repo is a huge blunder.

I'm seeing this from npm, which is a bit different:

https://www.npmjs.com/package/playcaptcha

Not saying the package is malicious, (although it might be, but it's a more likely threat that the devs themselves become infected by a supply chain worm and spread it downstream.) just saying, if you are going to audit it, actually audit it as if you were up against an attacker.

link
GuestFAUniverse 10 days ago
npm install randomgotcha
link