Reply to thread

Message

<blockquote data-quote="notabot" data-source="post: 830046" data-attributes="member: 75970">To give a concrete example of what I&#039;m talking about. In my old machine I run Sophos Home Premium, about 1-2 years ago I had fetched some github projects via git clone --recursive . Last week (!!!) Sophos found one of the dependencies had malware . I didn&#039;t have any issues with any accounts so far but clearly a malicious node module has access to node&#039;s JS runtime which in this case is a lolbin.It&#039;s a mix of supply chain attack and lolbins that come into play. I didn&#039;t have any issues so far with any of my accounts or cards (2FA is NOT on my PC anyhow) probably my own code didn&#039;t make calls to the infected parts of the module, so I&#039;m not worrying about this specific incident but more about this class of threatsI&#039;m fairly confident I won&#039;t run anything silly when I open a document or a pdf but this sort of attack is impossible to detect, judging by the outcome, AVs are not quick to spot these either, probably because they target small developer communities and AV vendors don&#039;t get enough samples.A HIPS may be handy, if eg while running a node app I get a warning the process trying to open eg powershell, it&#039;s pretty clear something odd is going on.</blockquote>

[QUOTE="notabot, post: 830046, member: 75970"] To give a concrete example of what I'm talking about. In my old machine I run Sophos Home Premium, about 1-2 years ago I had fetched some github projects via git clone --recursive . Last week (!!!) Sophos found one of the dependencies had malware . I didn't have any issues with any accounts so far but clearly a malicious node module has access to node's JS runtime which in this case is a lolbin. It's a mix of supply chain attack and lolbins that come into play. I didn't have any issues so far with any of my accounts or cards (2FA is NOT on my PC anyhow) probably my own code didn't make calls to the infected parts of the module, so I'm not worrying about this specific incident but more about this class of threats I'm fairly confident I won't run anything silly when I open a document or a pdf but this sort of attack is impossible to detect, judging by the outcome, AVs are not quick to spot these either, probably because they target small developer communities and AV vendors don't get enough samples. A HIPS may be handy, if eg while running a node app I get a warning the process trying to open eg powershell, it's pretty clear something odd is going on. [/QUOTE]

Verification