New node-ipc update deletes your harddrive if you have a russian or belarusian ip address. Pushed via github and NPM (node.js package manager).
They didn't troll russians though; they ended up deleting evidence of russian war crimes against ukranians and leftist NGO's are going to have them arrested for terrorism.
>can't into using test or staging before moving shit into production >not auditing what you pull in
got what they fucking deserved desu
Jackson Gonzalez
I'm still trying to figure out if the async issues would actually allow the code to delete files on your PC or not. Bit lazy as to run it in a vm tho.
Jose Taylor
>not auditing what you pull in The node-ipc package didn't have much of an update to be audited for. What happened here was the dev created the malware package, then went back to node-ipc and included the malware as a dependency in order for node-ipc to run then force pushed an update. Even if audited, it was obfuscated by the dev in an attempt to actively hide it. On top of this, node-ipc is very heavily used even by large companies and programs like Unity, because of this Unity actually ended up directly installing this malware into its own users computers.
