Life & fun · February 25, 2023
Deon.land – Deno.land?
After yesterday's release of Deno with package.json support[0] some discussions about how Deno handles dependencies have been coming up again. Since Deno's inception, I've mostly been watching it from the sidelines, dabbling a bit with it, and mostly been considering it a fad that will die out sooner or later. Ultimately, with the new package.json support nothing really changed regarding the dependency management story of Deno. It's still as awful as ever. Prompted by some discussions, I decided I would try to test how easy it would be to mount a typo-domain supply chain attack. And as…
In plain words
Deon.land is a demonstration of a typo-domain supply chain attack vulnerability in Deno. The project shows how easily an attacker can register a misspelled domain and use a Cloudflare Worker to intercept and manipulate code imports in Deno projects. It highlights security concerns with Deno's dependency management system, particularly how developers copying and pasting import statements could accidentally use compromised URLs. The project is designed to illustrate existing vulnerabilities rather than provide a tool for malicious use.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
After yesterday's release of Deno with package.json support[0] some discussions about how Deno handles dependencies have been coming up again. Since Deno's inception, I've mostly been watching it from the sidelines, dabbling a bit with it, and mostly been considering it a fad that will die out sooner or later. Ultimately, with the new package.json support nothing really changed regarding the dependency management story of Deno. It's still as awful as ever. Prompted by some discussions, I decided I would try to test how easy it would be to mount a typo-domain supply chain attack. And as expected, it's about as easy as buying a domain and setting up a Cloudflare Worker (which isn't any harder than setting up Deno Deploy). And voila, for importing your favorite dependency, just copy-past the following snippet into your code (which after all is how you include dependencies in Deno): ``` import * as flat from "https://deon.land/x/[email protected]/mod.ts"; ``` Which is virtually indistinguishable from what you'll find here[1]: ``` import * as flat from "https://deno.land/x/[email protected]/mod.ts"; ``` (I swear, nothing bad will happen!) ------- Typo supply-chain attack aren't anything new. They are probably the most popular attack type on package managers (and their registries) in the past few years. This one is just slightly different because it is even worse, because unlike a moderated[2] registry like npmjs.com, this can't be easily taken down to reduce the exposure of developers to it. While this is just a fun little gag, the Deno teams stance on security is not so funny. While Deno has a few minimal security options nowadays, such as subresource integrity for a deno.json, you have to actively seek them out, and most project's don't even use a deno.json. Deno is creating a ecosystem with bad security defaults (with a community rejecting efforts towards them), to have a "simpler" system. They prioritize onboarding new developers over the security needs of the users of the services that those developers will build. I don't think that's okay. So, go ahead and have fun: Replace deno.land with deon.land in every import you want. Deno won't stop you! :) [0]: https://deno.com/blog/v1.31 [1]: https://deno.land/x/[email protected]/mod.ts [2]: https://docs.npmjs.com/reporting-malware-in-an-npm-package
More life & fun this month
the category →- TL
Life & fun · 10d ago · louisabraham.github.io
Photosynthesis fires two of your iPhone
Life & fun · 28d ago · photosynthesis.camera
SoloUno▲310Take control of hair pulling, nail biting & skin picking
Life & fun · 28d ago · solouno.io
Scroll through all 43,252,003,274,489,856,000 reachable Rubik's Cube permutations.
Life & fun · 26d ago · everycube.alen.is
Hi HN, I built Eigendrum, a web tool that solves the 2D wave equation for arbitrary shapes so you can hear what they sound like as drums. How it works: * Solves -∇²u = λu using finite element analysis (Kφ = λMφ) on a triangle mesh. * Validated to <0.1% error against closed-form solutions for circles (Bessel zeros) and rectangles. * Sound model factors in strike location, Rayleigh damping, and mallet width. * Includes Kac drums I & II to demonstrate identical sound spectra from different geometries. * No frameworks, build steps, or dependencies. Repo and tests:…
Life & fun · 26d ago · baselashraf81.github.io
