Excerpts:<p>"So the only requirement for the victim is to install the library browser-redirect and add it to Express app, like a regular middleware:"<p>[...]<p>"I [Article Author] just published the malicious package to npm using npm install browser-redirect@1.0.2. <i>However, in Github you can’t see the malicious code</i> — see Master Branch and release 1.0.2. The reason for this is because npm does not check against Github or any other source control repository."<p>Security Perspective Takeaways:<p>1) Downloading and building source code, where authentication is performed between the downloaded source and the exact GitHub branch (rather than downloading a pre-built package or even source code where this branch authentication is not performed) would at least guarantee that the source code could be matched to the source on github, and could be subsequently audited...<p>2) The broader class of this attack (which includes such things as Windows Update, software auto-updaters, installers and package managers - both Windows and Linux) is basically: download malicious code - inside of a (user) believed non-malicious binary or library...<p>3) There are some very strong arguments here towards:<p><pre><code> a) Always use open source for whatever you can;
b) Always download and compile the source for whatever you can;
c) Always audit source that you've downloaded...
</code></pre>
I know; easier said than done...