@GossiTheDog Now if only there was a song about that : https://suno.com/song/9f55903e-c974-40fa-a62c-64595f0576a8
Just One Package More
Listen and make your own on Suno.
Erlend Oftedal
- 441 Followers
- 129 Following
- 28 Posts
@sawaba @GossiTheDog npm install scripts are definitely the most common way. But it makes sense to hide it in the actual code as well, especially if it is used in dev dependencies and thus runs frequently on developer machines. As an example the «debug» package has ~60k dependents.
Patricia Aas✨Tickets for AdaCon✨ the FREE Oslo tech conference ( @adacon) are now available! The conference is for everyone regardless of background or identity 🙌
https://adacon.no/#tickets
https://adacon.no/#tickets
aldroidia
Listening to the latest Risky Business podcast episode makes me wonder if Microsoft has or should have something similar to Certificate Transparency logs, but for Windows drivers.
Could also include build provenance.
Could also include build provenance.
@anderseknert Thank you for speaking at our #owasp chapter!
Anders EknertFriends in #Norway! 🇳🇴 And I'm lucky to have many of those by now. June 29 I will be talking #OpenPolicyAgent and all things related at the local #OWASP meetup. Come join me, @webtonull and a whole bunch of other smart and fun people for what I'm sure will be a great event. Not many spots left, so make sure to RSVP right away.
The good news is that we managed to get CVE-2022-23529 revoked. The bad news is we won’t get back the time devs and sec engineers around the world spent triaging and fixing this. Lets do better goin forward. CVEs should have a meaningful attack path.
Møt ChatGPT's litt mindre intelligente onkel: ChatEDB
https://erlend.oftedal.no/chat-edb/
https://erlend.oftedal.no/chat-edb/
[GHSA-27h2-hvpr-p74q] jsonwebtoken has insecure input validation in jwt.verify function by MichaelErmer · Pull Request #1595 · github/advisory-database
Updates CVSS Severity Comments The CVE is a joke, it requires the „attacker“ to create an object in the application context, not just parsed JSON but an object with an executable function. This c...