Stack Overflow Archives

A severe security flaw affecting "virtually every production Node.js app" that, if properly exploited, may result in a denial-of-service (DoS) condition has been fixed by Node.js through upgrades. In a Tuesday bulletin, Matteo Collina and Joyee Cheung of Node.js stated that Node.js/V8 makes a best-effort attempt to recover from stack space exhaustion with a catchable error, which frameworks have grown to rely on for service availability. This attempt would be thwarted by a flaw that only occurs when async_hooks are utilized, which would cause Node.js to exit with 7 without generating a catchable error when user code recursions exhaust the stack space. Applications that rely on unsanitized input to manage their recursion depth are therefore susceptible to denial-of-service attacks. ...

By using Stack Overflow to promote a malicious PyPi package that installs Windows information-stealing spyware, cybercriminals are exploiting the platform to distribute malware in an intriguing way. This new PyPi package is a part of a previously known 'Cool package' campaign, named after a string in the package's metadata, that targeted Windows users last year, according to research by Sonatype and writer for BleepingComputer, Ax Sharma. Threat actors submitted the PyPi package 'pytoileur' to the PyPi repository over the weekend, claiming it to be an API administration tool. Observe that the package is a part of this ongoing campaign because it has the "Cool package" string in the Summary metadata field read more Cybercriminals pose as "helpful" Stack Overflow users to push malware...

Tag: Stack Overflow

Critical Node.js Vulnerability Can Cause Server Crashes via async_hooks Stack Overflow

Cybercriminals pose as “helpful” Stack Overflow users to push malware