How a Single Vulnerability Can Bring Down the JavaScript Ecosystem

PR sneaking

A repository demonstrating how you can sneak malicious code into Github PRs

Why npm lockfiles can be a security blindspot for injecting malicious modules

Malicious code can be injected into npm projects via lockfiles (package-lock.json or yarn.lock) because these large, machine-generated files are rarely reviewed thoroughly

Remove evidence of malicious pull requests on GitHub

Changing account's email to block-listed domain, automatically bans the account

GitHub comments abused to push malware via Microsoft repo URLs

Hidden GitHub comment link