Record · socket.dev
npm bin script confusion: Abusing ‘bin’ to hijack ‘node’ command
Socket Engineering · 19 October 2022 · 6 min read
A post on socket.dev, published 19 October 2022, is cited by 1 distinct blog to date (corpus.blog, measured 11 October 2026).
A record is what was published and who pointed at it. The text of the post is not shown here: read it at the source, or at its Wayback capture.
1blog citing
| Period | Blogs | Links |
|---|---|---|
| All time | 1 | 1 |
| Last 90 days | 0 | 0 |
| Last 30 days | 0 | 0 |
| Last 7 days | 0 | 0 |
| First cited | 13 Feb 2025 |
|---|---|
| Latest citation | 13 Feb 2025 |
| Words blogs link it with | 1 |
| External links | 17 |
| Length | 1,292 |
Words blogs link it with
The words blogs link this page with, by how many different blogs use them.
- performed shell injection attacks1 blog
Cited by 1 blog in 1 post
One row per blog, the most recently citing first. Each shows the blog's newest citing post; open a row for the others.
Blog
Newest citing post
Date
Deno Blog1 post
If you're not using npm specifiers, you're doing it wrong
linked as “performed shell injection attacks”
Read at deno.com (opens in a new tab)13 Feb 2025
Links from this post
Link
Host
npmjs.com
https://www.bleepingcomputer.com/news/security/241-npm-and-pypi-packages-caught-dropping-linux-cryptominers/ Who cites this page
bleepingcomputer.com
https://www.bleepingcomputer.com/news/security/malicious-npm-libraries-install-ransomware-password-stealer/ Who cites this page
bleepingcomputer.com
en.wikipedia.org
en.wikipedia.org
blog.daniel-ruf.de
blog.npmjs.org
develop.secure.software
Elsewhere on socket.dev (7)
socket.dev
socket.dev
Something wrong here? Report a problem