Unpkg.com hacked?

20 pointsbenaiah8y ago13 comments

I've checked on both my local machine and on a VPS I run, and the following URL is 302 redirecting to a malicious JS script which pops up a confirmation window and then redirects to ads:

SOURCE URL: https://unpkg.com/react@latest/dist/react.js MALICIOUS REDIRECT: https://compliance-jessica.xyz/a.php

This is the URL recommended for in-browser development use by https://facebook.github.io/react/docs/installation.html

Can anyone else replicate this?

13 comments

NuclearFishin8y ago

Looks like there was indeed an issue with a bad nameserver update:

https://twitter.com/unpkg/status/852660203275276289

1 more reply

Erd0s68y ago

I was having this issue to but all good now. Should I be concerned about my computer being infected from this? Virus scans don't find anything

davidjgraph8y ago

unpkg are reporting this as fixed. https://twitter.com/unpkg/status/852668919768694784.

We got hit pretty hard for the 50 minutes or so the problem existed, Dropbox host their JS SDK lib on there...

davidkhess8y ago

Seeing the same thing when trying to load Vue.

Tweet from them:

https://twitter.com/unpkg/status/852655106562564098

> We're experiencing some issues and working on it. Will post updates here as soon as we know more.

benaiahOP8y ago

Yeah, one of the Twitter replies seems to indicate this is a widespread issue.

EDIT: apparently it was a bad nameserver update: https://twitter.com/unpkg/status/852658357034827776

davidkhess8y ago

Hhhmmm. According to DNS, I'm talking straight at a Cloudflare IP and getting a redirect to adware when trying to load Vue.

Evidence here: https://pastebin.com/wVCABkaA

CorySimmons8y ago

We got close to trending on HackerNews yesterday when this happened.

Suddenly every visitor was reporting alert dialogs saying they had a virus and our votes dropped off a cliff.

Last time I ever go against my gut and semi-trust anything.

himlion8y ago

Use subresource integrity and this would have affected you less. Still a non functioning site unfortunately.

DorianDevelops8y ago

Sucks just got this on my github portfolio page that I put up a few days ago.

Any way to fix???

benaiahOP8y ago

Certainly - download the original version of whatever scripts you're using and host them from your own domain, instead of unpkg.

shanecleveland8y ago

Create fallbacks for future cases: https://css-tricks.com/snippets/jquery/fallback-for-cdn-host...

murftown8y ago

Yes, I experienced the same thing.

svdpeijl8y ago

here too - same thing.. this is ridiculous what a HUGE blunder on unpkg.com part

j / k navigate · click thread line to collapse

Unpkg.com hacked?

20 pointsbenaiah8y ago13 comments

I've checked on both my local machine and on a VPS I run, and the following URL is 302 redirecting to a malicious JS script which pops up a confirmation window and then redirects to ads:

SOURCE URL: https://unpkg.com/react@latest/dist/react.js MALICIOUS REDIRECT: https://compliance-jessica.xyz/a.php

This is the URL recommended for in-browser development use by https://facebook.github.io/react/docs/installation.html

Can anyone else replicate this?

13 comments

NuclearFishin8y ago

Looks like there was indeed an issue with a bad nameserver update:

https://twitter.com/unpkg/status/852660203275276289

1 more reply

Erd0s68y ago

I was having this issue to but all good now. Should I be concerned about my computer being infected from this? Virus scans don't find anything

davidjgraph8y ago

unpkg are reporting this as fixed. https://twitter.com/unpkg/status/852668919768694784.

We got hit pretty hard for the 50 minutes or so the problem existed, Dropbox host their JS SDK lib on there...

davidkhess8y ago

Seeing the same thing when trying to load Vue.

Tweet from them:

https://twitter.com/unpkg/status/852655106562564098

> We're experiencing some issues and working on it. Will post updates here as soon as we know more.

benaiahOP8y ago

Yeah, one of the Twitter replies seems to indicate this is a widespread issue.

EDIT: apparently it was a bad nameserver update: https://twitter.com/unpkg/status/852658357034827776

davidkhess8y ago

Hhhmmm. According to DNS, I'm talking straight at a Cloudflare IP and getting a redirect to adware when trying to load Vue.

Evidence here: https://pastebin.com/wVCABkaA

CorySimmons8y ago

We got close to trending on HackerNews yesterday when this happened.

Suddenly every visitor was reporting alert dialogs saying they had a virus and our votes dropped off a cliff.

Last time I ever go against my gut and semi-trust anything.

himlion8y ago

Use subresource integrity and this would have affected you less. Still a non functioning site unfortunately.

DorianDevelops8y ago

Sucks just got this on my github portfolio page that I put up a few days ago.

Any way to fix???

benaiahOP8y ago

Certainly - download the original version of whatever scripts you're using and host them from your own domain, instead of unpkg.

shanecleveland8y ago

Create fallbacks for future cases: https://css-tricks.com/snippets/jquery/fallback-for-cdn-host...

murftown8y ago

Yes, I experienced the same thing.

svdpeijl8y ago

here too - same thing.. this is ridiculous what a HUGE blunder on unpkg.com part

j / k navigate · click thread line to collapse