The JavaScript Supply Chain Paradox: SRI, CSP and Trust in Third Party Libraries
Troy Hunt
FEBRUARY 11, 2018
This tag was in the source code over at secure.donaldjtrump.com/donate-homepage yet it was pulling script directly off Igor Escobar's GitHub repository for the project. Modify the DOM, redirect the user, load in external content, challenge visitors to install software, add a key logger and grab any non- HTTP only cookies. Until now.
97 
Let's personalize your content