The GitVenom campaign: cryptocurrency theft using GitHub
4 comments
·February 26, 2025Sophira
from-nibly
I agree that downloading from git directly is dumb but for other reasons. Regular npm packages don't have to have any relationship to the source code repository. You can just upload whatever files you want and call it version x and then in git tag a commit with completely different files in it.
npm doesn't review the files uploaded to npm unless there is some sort of report.
Sophira
Oh dear, I didn't realise this. I knew that GitHub Release archives could have different files in them - for example, see the xz backdoor recently - but I didn't realise that npm would use those by default.
from-nibly
It doesn't use the releases. It just bundles up whatever files you tell it to.
> Blindly running code from GitHub can be detrimental
And this is exactly why I dislike how most dependency managers nowadays (especially npm) use GitHub directly. I prefer something where somebody other than the dev has reviewed the code. As it is, I could be installing literally anything.