Conversation

Notices

1. Embed this notice
   Lance R. Vick (lrvick@mastodon.social)'s status on Monday, 15-Jan-2024 09:32:51 JST Lance R. Vick

   in reply to

   I just noticed "foreach" on npm is controlled by a single maintainer.

   I also noticed they let their personal email domain expire, so I bought it before someone else did.

   I now control "foreach" on NPM, and the 36826 projects that depend on it.

   • Embed this notice
     Lance R. Vick (lrvick@mastodon.social)'s status on Monday, 15-Jan-2024 09:32:52 JST Lance R. Vick

     1. Buy expired NPM maintainer email domains.
     2. Re-create maintainer emails
     3. Take over packages
     4. Submit legitimate security patches that include package.json version bumps to malicious dependency you pushed
     5. Enjoy world domination.

     Doughnut Lollipop 【記録係】:blobfoxgooglymlem: repeated this.