ReferenceIncidents
Era 4 · Series BSupply-chain compromise
A dependency published a malicious version, and a deploy installed it. The package ran in the App Servers and shipped data out.
What happens#
A dependency published a malicious version, and a deploy installed it. The package ran in the App Servers and shipped data out.
How to prevent it#
Dependency scanning catches a published backdoor before the build installs it; Deno permissions keep a package from reading what it does not need.
The postmortem opens the first of these that you do not own yet: