Comment on How Hackers Use NPMSCan.com to Hack Web Apps (Next.js, Nuxt.js, React, Bun)

block_hacks@lemmy.world ⁨1⁩ ⁨week⁩ ago

• just_another_person@lemmy.world ⁨1⁩ ⁨week⁩ ago

  If this is your content, I have some pointers.

  source

  • HellieSkellie@lemmy.dbzer0.com ⁨1⁩ ⁨week⁩ ago

    What pointers do ya got

    source

    • just_another_person@lemmy.world ⁨1⁩ ⁨week⁩ ago

      (typing quickly, excuse errors)

      Title: The title is both confusing and misleading to the actual topic being discussed, which is CVEs being used to identify vulnerabilities to be exploited. The tool is irrelevant, and the tool in the headline is actually mentioned very little in the content.

      Staying on topic: the title sets out a few things as the topics: 1) NPMScan 2) Vulnerabilities 3) Frameworks being exploited.

      It then shifts in the first details to middleware exploits, and how routes are mishandled. So a reader might be asking "Wait, is this a post about middleware attacks, or something specific to NPMScan/CVE exploits?

      A title or headline should be a simple summarization of the topics discussed, and the content should stick to what those topics are. A more accurate title to this piece would be “How Hackers use CVE information to craft exploits in X, Y and Z”

      Diversion from topics: While keeping the meat of an article as close to the main topic thread, it’s important explain the when/where/why you are diverting from that thread for context. When doing so, you’re explaining the relationship between your main topic, and this new information being pertinent and important to the discussion overall.

      Just adding a bunch of unrelated information leaves the reader confused about what those ties to the main thread are, and usually will be forgotten or skipped if they came to your content based on the headline and looking for specific information.

      An example of this being used horribly all over the place is recipe sites. You go looking for a Holiday Cookie recipe, and are presented with with pages of journal entries about the authors childhood cookie memories. It’s not pertinent to the actual content being requested, and people will skip it.

      source

      • block_hacks@lemmy.world ⁨1⁩ ⁨week⁩ ago

        Yeah, this is my write-up – appreciate you taking the time to actually read and critique it.

        You’re right on a few things:

        • The title is doing a lot at once.
        • The piece drifts between “how attackers think about CVEs/deps” and “how that shows up as middleware/payload/framework bugs.”

        Where I disagree a bit is on “the tool is irrelevant” – NPMSCan in this context isn’t meant to be the star of the show, it’s the lens:

        • I’m using NPMSCan as the recon surface: maintainer churn, weird postinstall scripts, version diffs, dead owners, sketchy publish timelines, etc.
        • From that, the article pivots into: “OK, if you see this dependency pattern in a typical Next/Nuxt/React/Bun app, here’s the kind of bug path it usually maps to: auth bypass, cache poisoning, SSRF, Nuxt payload traversal, Bun command injection, etc.”

        So it’s less “product article about NPMSCan,” more “here’s how a scanner + public npm metadata + framework conventions = realistic exploit paths.”

        That said, your title suggestion is fair. Something like:

        “How attackers turn CVE + npm metadata into real exploits in Next.js / Nuxt / React apps”

        …is probably closer to what’s actually happening in the piece than the current headline. I might tweak it along those lines on future posts / cross-posts.

        On the “diversions”: the middleware examples, route mishandling, etc. are meant as the downstream effects of bad dependency hygiene + vulnerable packages — but I agree I could have been more explicit when I switch from “scanner view” to “app behavior view” so people don’t feel like I’m jumping topics.

        Anyway, thanks for the honest feedback. If there’s a specific section you felt was most off-topic or weakest, I’m happy to tighten it up in a follow-up or a v2 focused purely on one angle (e.g. “just cache-poisoning chains from npm deps”).

        source

        • -> View More Comments