search

dwyl / learn-security

:closed_lock_with_key: For most technology projects Security is an "after thought", it does not have to be that way; let's be proactive!
67 stars 10 forks source link

Backdoored Dependency in Event Stream #50

Open nelsonic opened 5 years ago

nelsonic commented 5 years ago

An example of how security naivety can cause harm:

https://github.com/dominictarr/event-stream/issues/115 image

https://github.com/dominictarr/event-stream/issues/116 image

discussion: https://news.ycombinator.com/item?id=18534392

This in a nutshell is why Node.js is a house of cards that cannot be trusted from a security perspective. 💔

Meta/Note: I've opened this issue to hold the basic details of a post on security. ✍️ Sadly, most people don't care about security, they only want to get their current work done, collect their paycheque and get back to their hobbies/socialising/netflix. 😞