Thanks, great read. And a real eye-opener -- leading to immediately (re-)set all my browsers master passwords, which unless one does so are just laying around in plaintext(
!) in a '
logins.json' file in your profile folder -- if you're a
Firefox user that is.
For general awareness (and
TL;DR), the article details how Nirsoft's
WebBrowserPassView can be a
PUA in certain contexts.
Also, please note the following highlights...
A single line of code that changes the logic of the program can be a backdoor that allows unauthorized access to the system. Similarly, a single line of code is all it takes for a script to reach out to a remote server and download instructions to execute on the infected machine. Because of this, such supply chain attacks are usually detected post-infection, by developers themselves, upon realization that something odd is going on in the system.
NPM, node package manager, aimed primarily at JavaScript developers, is one such behemoth. It hosts almost 9M packages, which in turn consist of 1.7 billion files, or just under 37.5TB worth of data - numbers that are only getting bigger with each passing day.