Hacker News Reader

There are many people who could pull off an attack like that if they were so inclined.

You need ability, means (as in -- have the money to spend time on it), and motive. Many people have the ability. Many people have the means. (And there is some overlap, but the overlap isn't that large.) Few people have the motive.

The combination of all three tends to mostly appear in nation states. They have the motive, and they have the money to fund people with the ability to pull off this kind of attack.

Exactly, most of us need to work and aren't motivated enough to spend our free time committing crimes. I also assume this is full time work. From my limited perspective the hardest part was the time investment and gaining enough trust to put the code into action.

Most of the time you can just buy an expired domain name tied to a js include or dependency maintainer email address and you now have arguably -legal- ability to publish any code you want to thousands of orgs.

Plenty of expired npm maintainer email domains right now. Have fun.

I have done it twice to bring exposure to the issue. Seemingly no one cares enough to do the most basic things like code signing.

Reply on news.ycombinator.com