How exactly does that work? I don't think that HNers understand the recent suppl...

yearolinuxdsktp · 2026-07-15T14:44:35 1784126675

That’s a bold claim to make about HNers. Au contraire, security companies have absolutely missed supply chain attacks.

Example:

https://snyk.io/blog/node-gyp-supply-chain-compromise-self-p...

Before that we had event-stream, then we had XZ compromise.

It’s not exceptionally hard to delay reaching out to external sites until after a cooldown period.

drdexebtjl · 2026-07-15T04:15:25 1784088925

    def steal_your_data():
      if datetime.now() < three_days_after_attack:
        return
      reach_out_to_external_sites()

mplewis · 2026-07-15T04:23:39 1784089419

OK, so it looks like you've still added suspicious code to your package.

drdexebtjl · 2026-07-15T04:47:08 1784090828

You can make it much less suspicious. In particular, if you can compromise the package publishing process, and not just pushes to main, you can add your malicious code to binary artifacts, not to the source code.