Hacker News Reader

Comment by cyral | Hacker News Reader

Your first paragraph reminded me of this article: https://david-gilbertson.medium.com/im-harvesting-credit-car... Imagine this scenario taking place with this package if someone got ahold of his NPM account.

View on HN

Oooh thanks, I had been looking to find that article again for a while and couldn't track it down for anything.

In a completely unrelated matter, Google search results quality has really declined in the last few years...

I know far too well how you feel, happy you found what you’ve been missing.

Out of curiosity, what did you remember about the link that you tried searching for? Do you remember when you last saw it?

[insert semicoherent hopium about ChatGPT as a magical panacea here]

I remembered it as an article where a guy semi-jokingly claimed to have hacked most of the web through a supply-chain exploit and listed off a ton of clever things he did to evade all of the immediately obvious ways to notice that such a thing was happening. Pretty sure I saw it here on HN originally, but I couldn't come up with any search terms to find it in Google, Bing, DDG, HN Angolia search, etc.

The author said he updated the article, so if the link changed then maybe; however, I can tell you somebody definitely reposted it last night and it got almost 100 points. Too funny.

I assume you tried punching in keywords like “fake NPM package hack” or something like that?

Pretty much yeah, and no combination I could come up with brought up the article on the first few pages, mostly just infosec blogspam. Of course it might actually show up in searches now, since it's been on the HN front page in the last 24 hours.

Reply on news.ycombinator.com