Unpkg.com hacked?

20 points by benaiah 9 years ago | 13 comments

I've checked on both my local machine and on a VPS I run, and the following URL is 302 redirecting to a malicious JS script which pops up a confirmation window and then redirects to ads:

SOURCE URL: https://unpkg.com/react@latest/dist/react.js MALICIOUS REDIRECT: https://compliance-jessica.xyz/a.php

This is the URL recommended for in-browser development use by https://facebook.github.io/react/docs/installation.html

Can anyone else replicate this?

NuclearFishin 9 years ago |

Looks like there was indeed an issue with a bad nameserver update:

https://twitter.com/unpkg/status/852660203275276289

Erd0s6 9 years ago |

I was having this issue to but all good now. Should I be concerned about my computer being infected from this? Virus scans don't find anything

davidjgraph 9 years ago |

unpkg are reporting this as fixed. https://twitter.com/unpkg/status/852668919768694784.

We got hit pretty hard for the 50 minutes or so the problem existed, Dropbox host their JS SDK lib on there...

davidkhess 9 years ago |

Seeing the same thing when trying to load Vue.

Tweet from them:

https://twitter.com/unpkg/status/852655106562564098

> We're experiencing some issues and working on it. Will post updates here as soon as we know more.

benaiah 9 years ago | |

Yeah, one of the Twitter replies seems to indicate this is a widespread issue.

EDIT: apparently it was a bad nameserver update: https://twitter.com/unpkg/status/852658357034827776

davidkhess 9 years ago | | |

Hhhmmm. According to DNS, I'm talking straight at a Cloudflare IP and getting a redirect to adware when trying to load Vue.

Evidence here: https://pastebin.com/wVCABkaA

CorySimmons 9 years ago |

We got close to trending on HackerNews yesterday when this happened.

Suddenly every visitor was reporting alert dialogs saying they had a virus and our votes dropped off a cliff.

Last time I ever go against my gut and semi-trust anything.

himlion 9 years ago |

Use subresource integrity and this would have affected you less. Still a non functioning site unfortunately.

DorianDevelops 9 years ago |

Sucks just got this on my github portfolio page that I put up a few days ago.

Any way to fix???

benaiah 9 years ago | |

Certainly - download the original version of whatever scripts you're using and host them from your own domain, instead of unpkg.

shanecleveland 9 years ago | | |

Create fallbacks for future cases: https://css-tricks.com/snippets/jquery/fallback-for-cdn-host...

murftown 9 years ago |

Yes, I experienced the same thing.

svdpeijl 9 years ago |

here too - same thing.. this is ridiculous what a HUGE blunder on unpkg.com part