Malicious NPM package targets prettier library (opens in new tab)

So if I understand the article correctly, the malicious .exe file was disguised using a Unicode right-to-left override (RTLO) attack?

> Generally, it’s a good idea not to blindly install NPM packages.

Given the nature of npm that is pretty hard to avoid.

Very interesting read, very impressive. With GitHub’s new feature of custom repository properties it can be so easy to implement a confirmation mechanism between a repository and an npm package, but I guess it could have implemented with other means long time ago.

wow, it ain't pretty!