What if a package did something like this, but instead of logging to the console, they sent it back to a server?
Have you actually reviewed every dependency and every child dependency in every app you deploy?
Why are people not more scared of this?
Last active
June 14, 2017 21:45
-
-
Save kevincennis/7bbd2f3103d8eae8ad046be08665e6f4 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // intercept and log every single http request on this server | |
| const { IncomingMessage } = require('http'); | |
| const push = IncomingMessage.prototype.push; | |
| IncomingMessage.prototype.push = function( chunk, encoding, done ) { | |
| const result = push.call( this, chunk, encoding, done ); | |
| if ( chunk === null ) { | |
| return; | |
| } | |
| const decoded = chunk instanceof Buffer ? chunk.toString( encoding ) : chunk; | |
| console.log( `I spied on a user that sent: ${ decoded }` ); | |
| return result; | |
| }; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment