EvilPacket

Because software supply chain security is a giant tire fire Socket recently introduced Socket Firewall (sfw), self described as “a free tool that blocks malicious packages at install time, giving developers proactive protection against rising supply chain…

While cleaning up my MCP configuration I noticed that Cursor supports a deeplink to aid in the UX / installation of MCP servers.

Select a video to open the original recording.

In December I discovered a supply chain vulnerability that impacted 6,530 public npm package versions, at least I thought I did.

Last night I tossed up a quick CTF-esque challenge with a couple of flags defined.

I’m excited to finally write up and share my favorite vulnerability I’ve ever found.

Today I got my hands on an O.MG cable.

This last week Nick Starke got the chrome debugger metasploit module pushed over the line and merged into master.

I discovered an exposure on SAP’s BrilliantHire API - an exposed Node.js debugger instance that provided full remote code execution capabilities and access to sensitive AWS credentials, database encryption keys, and production source code.

Summary I discovered that developers do leave remote JavaScript debuggers and headless browsers laying around on the internet leading to sensitive data exposure and an interesting remote position for an attacker.

2021 Speakeasy JS - Attacking Open Source using Abandoned Resources 2020 OpenJS World - Fireside Chat on JavaScript Security Node.js Global Summit - JavaScript Supply Chain Security 2019 LocoMocoSec, JavaScript Supply Chain Security Container Security Sum…

Here are some vulnerabilities I’ve found over the years.

Capture the Flag and contest wins from competitions I’ve participated in over the years with team Psychoholics.

If you ever find Server Side Request Forgery (SSRF) in a node.js based application and the app is using the request module you can use a special url format to detect the existence of files / directories.

I’ve learned a long time ago that not all security research pans out with a stack of vulnerabilities but every time I venture down a rabbit hole I learn something along the way.

Before you read this post please run git --version and if it’s not 2.14.1 or greater then please go upgrade it.

The Practical Developer DevDiscuss one day got me thinking about mentorship and how it’s impacted my life.

Earlier this week Zach Grace published an article on one way that you could backdoor a Node.js Express application without touching disk.

Just before the New Years I published 140+ advisories on Node.js modules.

5 years ago at DEFCON 19 I gave a talked titled “Pillaging DVCS repos for fun and profit.”

Last year (2015) I had a thought, “who else is downloading and running / testing random modules on npm.”

Developers have increasingly become a more valuable target to compromise in recent years.

At the end of April I found a flaw in a module that Express and many other frameworks use.