HN

Comments (19)

• Menu

  j2kun
  Why in the world would that specific 3x3 matrix be a trigger for an attack? Are they trying to find someone doing some particular kind of numerical analysis?
• WorldMaker
  A lot of this seems to be a reminder that the CommonJS module format should just be left to die already. Not that you can't pull similar tricks with `await import()` in ESM, but you can't easily grep an entire dependency for dynamic `require()` half as easily as you can can `grep import\s*\(` for dynamic import and analysis tools for static `import` keyword are easy to use/build rather than no such thing for CommonJS.Someone thought I was joking when I said I always check JSR before NPM now, because I trust ESM so much more than CommonJS.
• nextzck
  Fascinating how intricate the target selection is on this
• hiddenvulkcan
  I actually came across someone that cracked it (or use Claude/China to crack it)Turns out the second stage is completely broken, which is even more odd..https://research.veryserious.systems/lusolve-and-you-shall-r...
• Menu

  fshafique
  Does the FBI or any other law-enforcement office follow up on these backdoors? Is this considered a crime, or even conspiracy to commit a crime, or is it only the act of using the backdoor that's a crime?I can also see that it's still up in NPM without any warning of any kind: - https://www.npmjs.com/package/mathmainBut the Github repo for the package and the author are down: - https://github.com/allendev12 - https://github.com/allendev12/mathmain
• Menu

  TZubiri
  My strategy of not using dependencies at all seems to be getting stronger everyday.Also no LLM generated skipping this hypetrain completely. Just hand written code I can personally vouch for. Code in exchange for cash, this is professional business, Boss.Btw, I'm available for hire, preferably by Pre Market Fit or pre-MVP startups, email in profile.
• Menu

  zzril
  Had I found sthg like this, I'd be proud to tell everyone and certainly enjoy doing the writeup. But this smells like it was ai-written...
• Menu

  altairprime
  > We found a remote access implant hidden inside [email protected], an npm package that copies the popular mathjs library.The NPM package not named in the clickbait-y post title is “mathmain@1.0.0”, for those who run into this particular site obstacle; the later packages also named are “mathsbase” and “math-universe”. (EDIT: I see the submission title has been updated, so that’s my complaint addressed, thanks mods!)Safedep, if you’re reading this, perhaps you should reconsider having that site feature applied to your post — or if it’s something you enabled in, say, Cloudflare, perhaps file a support ticket noting that their email protection is hiding package version strings.