Comment Comment by joshschreuder A similar attack happened on another Chrome extension last month (Social Fixer) with over 190k installs.In fact, judging by the exploit code, I would guess the same author, as the Social Fixer attack had a very similar hashed package on Unpkg as well.In that scenario the author also didn't have 2FA enabled: https://www.facebook.com/socialfixer/posts/10155117415829342I feel like Google should take the next step of requiring all extension developers to enable 2FA before being able to post an extension. parent joshschreuder 9 years ago
In fact, judging by the exploit code, I would guess the same author, as the Social Fixer attack had a very similar hashed package on Unpkg as well.
In that scenario the author also didn't have 2FA enabled: https://www.facebook.com/socialfixer/posts/10155117415829342
I feel like Google should take the next step of requiring all extension developers to enable 2FA before being able to post an extension.