Why npm lockfiles can be a security blindspot for injecting malicious modules

0 stars0 forks0 contributors

Overview

Malicious code can be injected into npm projects via lockfiles (package-lock.json or yarn.lock) because these large, machine-generated files are rarely reviewed thoroughly

Related Projects

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub

Last commit

Created

Links & Resources

Website

Included in

CI/CD Attacks578

PR sneaking

A repository demonstrating how you can sneak malicious code into Github PRs

Stars11

Forks1

Last commit9 years ago

Remove evidence of malicious pull requests on GitHub

Changing account's email to block-listed domain, automatically bans the account

Stars0

Forks0

Last commit

GitHub comments abused to push malware via Microsoft repo URLs

Hidden GitHub comment link

Stars0

Forks0

Last commit

How a Single Vulnerability Can Bring Down the JavaScript Ecosystem

Cache poisoning attack on the NPM registry rendering packages unavailable

Stars0

Forks0

Last commit