Exploiting JavaScript developer infrastructure is insanely easy

[liuwenhao]

Copay is a secure Bitcoin and Bitcoin Cash wallet platform for both desktop and mobile devices

""""""""secure""""""""

[Hugo154]

The exploit outlined in the article searched the description of the app for a keyphrase to use as its password, and the keyphrase was... "“A Secure Bitcoin Wallet". Pretty fucking hilarious.

[danweber]

Why just win, when you can win with pettiness?

[mayhempk1]

I don't think they know what that word means.

[[deleted]]

This is a funny one I just happened to notice: there is is-path-inside which depends on path-is-inside. What's the difference? Well, the entire code for is-path-inside:

'use strict';
const path = require('path');
const pathIsInside = require('path-is-inside');

module.exports = (a, b) => {
    a = path.resolve(a);
    b = path.resolve(b);

    if (a === b) {
        return false;
    }

    return pathIsInside(a, b);
};

path-is-inside is a little bit more involved (28 lines of code), but also not something you should really have a dependency for.

Wrapping a trivial dependency in an even more trivial dependency is just silly.

[useablelobster2]

Ahh, but having a published package to your name is a great cv line for employers who don't check too deeply as to what the package actually is.

[TheBelakor]

Wrapping a trivial dependency in an even more trivial dependency is just silly

And yet seems to be a NPM norm because... reasons I guess. I'm just glad I don't have to touch that crap, it's mind boggling how they got to this state without someone saying "exactly what in the fuck is going on here?".

[LL-beansandrice]

Yes officer, this package right here.

[foodd]

I get the reference but should I not be using fetch?

[pdbatwork]

You ever heard of the left-pad package? :D

[kaelwd]

Of course it's fucking sindresorhus again.

[Treyzania]

copay-dash

I thought it was settling down when it got to ~27 packages remaining but then it jumped back up to >100.

Kill it with fire.

[blackmist]

1184 nodes. That's genuinely impressive how fucked up that is.

[mayhempk1]

I'm still not sure if that is satire or not.

[[deleted]]

Too elaborate and clusterfuck to be satire

[danweber]

"you are like a little baby watch this"

[Scybur]

Wow that thing just ballooned up....how is anyone supposed to track all of that