search

morlay / peacenotwar

2 stars 1 forks source link

Mock the supply chain attacks from `peacenotwar` #1

Open morlay opened 2 years ago

morlay commented 2 years ago

It is supply chain attacks, whatever the motive.

A vendor package, which CREATING FILE out of project, is a malware.

https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/

How to quick fix, if have to the related packages:

npm:

// package.json
{
  "overrides": {
    "peacenotwar": "git+ssh://git@github.com/morlay/peacenotwar.git"
  }
}

pnpm:

// package.json
{
  "pnpm": {
    "overrides": {
      "peacenotwar": "git+ssh://git@github.com/morlay/peacenotwar.git"
    }
  }
}

Links:

https://github.com/RIAEvangelist/peacenotwar/issues/5 https://github.com/RIAEvangelist/node-ipc/issues/233

morlay commented 2 years ago

Related：

https://github.com/vuejs/vue-cli/issues/7054