---
id: 2295
title: "Open Source: It’s turtles all the way down."
source_domain: bugcrowd.com
source_url: "https://www.bugcrowd.com/blog/open-source-its-turtles-all-the-way-down/"
published_at: "2018-11-27T00:00:00Z"
tags: ["cloud", "supply-chain", "open-source", "npm", "casey-ellis", "software-security", "nodejs", "trojan"]
phying_url: "https://phying.com/item/2295"
lang: en
---

# Open Source: It’s turtles all the way down.

## Summary

Open source fuels modern software but breeds supply-chain risk: an attacker tricked his way into maintaining a 2M-install node.js library and shipped a trojan stealing crypto wallet credentials.

## Intelligence Metadata

- **Sources:** bugcrowd.com
- **Published:** 2018-11-27T00:00:00Z
- **Original:** https://www.bugcrowd.com/blog/open-source-its-turtles-all-the-way-down/
- **Phying News:** https://phying.com/item/2295