from Hacker News

Unpkg.com hacked?

by benaiah on 4/13/17, 10:58 PM with 13 comments

I've checked on both my local machine and on a VPS I run, and the following URL is 302 redirecting to a malicious JS script which pops up a confirmation window and then redirects to ads:

SOURCE URL: https://unpkg.com/react@latest/dist/react.js MALICIOUS REDIRECT: https://compliance-jessica.xyz/a.php

This is the URL recommended for in-browser development use by https://facebook.github.io/react/docs/installation.html

Can anyone else replicate this?

  • by NuclearFishin on 4/13/17, 11:37 PM

    Looks like there was indeed an issue with a bad nameserver update:

    https://twitter.com/unpkg/status/852660203275276289

  • by Erd0s6 on 4/14/17, 12:19 AM

    I was having this issue to but all good now. Should I be concerned about my computer being infected from this? Virus scans don't find anything

  • by davidjgraph on 4/13/17, 11:51 PM

    unpkg are reporting this as fixed. https://twitter.com/unpkg/status/852668919768694784.

    We got hit pretty hard for the 50 minutes or so the problem existed, Dropbox host their JS SDK lib on there...

  • by davidkhess on 4/13/17, 10:59 PM

    Seeing the same thing when trying to load Vue.

    Tweet from them:

    https://twitter.com/unpkg/status/852655106562564098

    > We're experiencing some issues and working on it. Will post updates here as soon as we know more.

  • by CorySimmons on 4/14/17, 2:38 PM

    We got close to trending on HackerNews yesterday when this happened.

    Suddenly every visitor was reporting alert dialogs saying they had a virus and our votes dropped off a cliff.

    Last time I ever go against my gut and semi-trust anything.

  • by himlion on 4/14/17, 5:41 AM

    Use subresource integrity and this would have affected you less. Still a non functioning site unfortunately.

  • by DorianDevelops on 4/13/17, 11:41 PM

    Sucks just got this on my github portfolio page that I put up a few days ago.

    Any way to fix???

  • by murftown on 4/13/17, 11:05 PM

    Yes, I experienced the same thing.

  • by svdpeijl on 4/13/17, 11:34 PM

    here too - same thing.. this is ridiculous what a HUGE blunder on unpkg.com part