bad.ninja

quiet chaos.

[bad.ninja @_badninja]

@cmsholdings Too late, I'm starting on monday

[bad.ninja @_badninja]

@OrderBookShow Moronic

[bad.ninja @_badninja]

@OrderBookShow Ironic

[bad.ninja @_badninja]

@Merridew__

[bad.ninja @_badninja]

@NoContextBrits Team lifejacket need to get their numbers up

[bad.ninja @_badninja]

@devchart

[bad.ninja @_badninja]

@options_insight TRADE

[bad.ninja @_badninja]

@CryptoParadyme the gold > btc rotation is coming

[bad.ninja @_badninja]

@tomcrown true if big

[bad.ninja @_badninja]

@onechancefreedm love the education here, lot of nuance I haven't seen elsewhere

[bad.ninja @_badninja]

Topnotch terrible map

[Terrible Maps @TerribleMaps]

Bigfoot sightings vs. people who own fursuits

[bad.ninja @_badninja]

@PauloMacro didn't even include the link to her course

[bad.ninja @_badninja]

@fejau_inc oh no the economy is strong

[bad.ninja @_badninja]

@BenKizemchuk run it hot

[David Holt @IDrawCharts]

after a long week of sitting at my desk I can't wait to continue sitting at my desk except this time for fun

[bad.ninja @_badninja]

@JSeyff @EricBalchunas darn, I've been waiting for the alt season announcement this whole time

[bad.ninja @_badninja]

@conksresearch

[bad.ninja @_badninja]

@NickWoolos *phew* I was worried there for a minute

[0xngmi @0xngmi]

Explanation of the current npm hack

In any website that uses this hacked dependency, it gives a chance to the hacker to inject malicious code, so for example when you click a "swap" button on a website, the code might replace the tx sent to your wallet with a tx sending money to hacker

But in your wallet you'd still see the bad tx and need to approve it, its not like you'll instantly get drained

Furthermore, this will only impact websites that pushed an update since the hacked npm package was published, as other projects will have the old version

And most projects pin their dependencies, so even if they push an update they'll keep using the old safe code

So your wallet is safe and the effective impact area is much smaller than "all websites", but since you cannot really know if a project pinned dependencies, or if they have some dynamically downloaded dependency (very unlikely), it's just safer to avoid using crypto websites till this blows over and they clean up the bad packages