Welcome • User Guide
ToS • Privacy • Canary
Donate • Bugs • License

©2026 Poal.co

131

Archive: https://archive.today/iit0y

From the post:

>I almost closed the file without reading it. Three days later I was killing processes in production at 2am, rotating every credential I own, and staring at a git commit with my name on it that I never made. If you’ve got an active Node project, you’ll probably want to check it before you finish reading this.

Archive: https://archive.today/iit0y From the post: >>I almost closed the file without reading it. Three days later I was killing processes in production at 2am, rotating every credential I own, and staring at a git commit with my name on it that I never made. If you’ve got an active Node project, you’ll probably want to check it before you finish reading this.
[–] • 1 pt

Then I diffed it online and discovered a wall of obfuscated code hidden after hundreds of empty spaces, like someone wanted you to stop scrolling before you ever saw it.

Clever. Hide the malicious code off the right of the viewport with a long string of spaces.

I’m surprised it worked. The default config in Vim and Neovim is to wrap long lines. I don’t even know the setting to turn that off, never needed to. This exploit will only work in certain editors. Even the online diff tool he used (GitHub?) nust have wrapped the text for him so he could see it.

I’m guessing Visual Studio Code doesn’t wrap long lines. That would make a large attack surface for this.

[–] • 1 pt

This is a huge reason why (for well over a decade) people have said "don't just copy and paste something from the web".