I’m harvesting credit card numbers and passwords from your site. Here’s how.
The best quote in the post in my opinion:
Lucky for me, we live in an age where people install npm packages like they’re popping pain killers.
This led to a discussion at our company whether or not a malicious NPM Package would fit into OWASP Top Ten 2017 or not. I think it could fit into the following categories:
The description says: "Not only must all operating systems, frameworks, libraries, and applications be securely configured...". If you have a malicious library that can do something because your
CSPis not configured correctly for example I would have it fall under this category.
A7:2017-Cross-Site Scripting (XSS)
If the library enables an XSS vulnerability it would fall under this category.
A9:2017-Using Components with Known Vulnerabilities
If the library is known to be malicious it would fall under this category.
Is this correct or is a malicious NPM package outside the scope of OWASP Top Ten 2017?