New ask Hacker News story: Backdoor injected to NPM express-cookies package Backdoor injected to NPM express-cookies package

Backdoor injected to NPM express-cookies package
52 by ekke | 8 comments on Hacker News.
Remote code injection vulnerability wild in public npm package, plausible-sounding 'express-cookies' and its dependency 'getcookies'. >10K downloads during April. Vulnerable code: https://ift.tt/2FzEZVN https://ift.tt/2KpZXdb

Remote code injection vulnerability wild in public npm package, plausible-sounding 'express-cookies' and its dependency 'getcookies'. >10K downloads during April. Vulnerable code: https://ift.tt/2FzEZVN https://ift.tt/2KpZXdb