GHSA-pjwm-rvh2-c87w
is-mobile
| GHSA-pjwm-rvh2-c87w | is-mobile | |
|---|---|---|
| 8 | 1 | |
| - | 220 | |
| - | - | |
| - | 3.6 | |
| - | 2 months ago | |
| JavaScript | ||
| - | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
GHSA-pjwm-rvh2-c87w
-
Attack Simulator for SolarWinds, Codecov, and ua-parser-js breaches
The SUNSPOT malware, Codecov breach, and lot of compromised open-source packages (like was the case with ua-parser-js) target the CI/ CD pipeline to modify release build or exfiltrate credentials.
- Embedded malware in ua-parser-js - critical severity
- Embedded malware in ua-parser-JS (NPM package)
-
PSA: Tor.com was hacked and is currently spreading malware
I think you are misunderstanding the attack vector in the article you linked. This isn't the same thing we were discussing, please see https://github.com/advisories/GHSA-pjwm-rvh2-c87w. This was not a compromise designed to go after the visitors of the website so far as I can tell (and even if it were, it couldn't do much except possibly steal a password if you entered it on a compromised site or steal cookie data). This was designed to target people who were using the library in their software, aka, it was targeting the build-chain of the developers, and many devs and companies as a result had computers compromised when the updated their versions, which caused the compromised version to download to their computers.
- Supply-chain attack on NPM Package UAParser, which has millions of daily downloads
- The npm package ua-parser-js had three versions (0.7.29, 0.8.0, 1.0.0) published with malicious code.
- Embedded crypto miner in ua-parser-JS
-
BREAKING!! NPM package ‘ua-parser-js’ with more than 7M weekly download is compromised
Github has published an advisory for the package https://github.com/advisories/GHSA-pjwm-rvh2-c87w
is-mobile
-
BREAKING!! NPM package ‘ua-parser-js’ with more than 7M weekly download is compromised
If your only goal is to be certain you're dealing with a mobile device, a specialized library like is-mobile is probably a better fit.
What are some alternatives?
npm-force-resolutions - Force npm to install a specific transitive dependency version
deno - A modern runtime for JavaScript and TypeScript.
micromatch - Highly optimized wildcard and glob matching library. Faster, drop-in replacement to minimatch and multimatch. Used by square, webpack, babel core, yarn, jest, ract-native, taro, bulma, browser-sync, stylelint, nyc, ava, and many others! Follow micromatch's author: https://github.com/jonschlinkert
handlebars-helpers - 188 handlebars helpers in ~20 categories. Can be used with Assemble, Ghost, YUI, express.js etc.
is-number - JavaScript/Node.js utility. Returns `true` if the value is a number or string number. Useful for checking regex match results, user input, parsed strings, etc.
open-source-at-scale - talk at budapest 2014
Dapper - Dapper - a simple object mapper for .Net [Moved to: https://github.com/DapperLib/Dapper]
ua-parser-js - UAParser.js - Free & open-source JavaScript library to detect user's Browser, Engine, OS, CPU, and Device type/model. Runs either in browser (client-side) or node.js (server-side).
NUnit - NUnit Framework
MediatR - Simple, unambitious mediator implementation in .NET