Skip to content(if available)orjump to list(if available)

The GitVenom campaign: cryptocurrency theft using GitHub

The GitVenom campaign: cryptocurrency theft using GitHub

3 comments

·February 26, 2025
Visit

Sophira

> Blindly running code from GitHub can be detrimental

And this is exactly why I dislike how most dependency managers nowadays (especially npm) use GitHub directly. I prefer something where somebody other than the dev has reviewed the code. As it is, I could be installing literally anything.

from-nibly

I agree that downloading from git directly is dumb but for other reasons. Regular npm packages don't have to have any relationship to the source code repository. You can just upload whatever files you want and call it version x and then in git tag a commit with completely different files in it.

npm doesn't review the files uploaded to npm unless there is some sort of report.

Sophira

Oh dear, I didn't realise this. I knew that GitHub Release archives could have different files in them - for example, see the xz backdoor recently - but I didn't realise that npm would use those by default.