Someone bought 30 WordPress plugins and planted a backdoor in all of them

This is a perfect illustration of what cracks me up about the hyperbolic reactions to Mythos. Yes, increased automation of cutting-edge vulnerability discovery will shake things up a bit. No, it's nowhere near the top of what should be keeping you awake at night if you're working in infosec.

We've built our existing tech stacks and corporate governance structures for a different era. If you want to credit one specific development for making things dramatically worse, it's cryptocurrencies, not AI. They've turned the cottage industry of malicious hacking into a multi-billion-dollar enterprise that's attractive even to rogue nations such as North Korea. And with this much at stake, they can afford to simply buy your software dependencies, or to offer one of your employees some retirement money in exchange for making a "mistake".

We know how to write software with very few bugs (although we often choose not to). We have no good plan for keeping big enterprises secure in this reality. Autonomous LLM agents will be used by ransomware gangs and similar operations, but they don't need FreeBSD exploit-writing capabilities for that.

Whenever I look at a web project, it starts with "npm install" and literally dozens of libraries get downloaded.

The project authors probably don't even know what libraries their project requires, because many of them are transitive dependencies. There is zero chance that they have checked those libraries for supply chain attacks.

The supply chain attack surface in WordPress plugins has always been particularly dangerous because the ecosystem encourages users to install many small single-purpose plugins from individual developers, most of whom aren't security-focused organizations. Buying out an established plugin with a large install base is a clever approach because you inherit years of user trust that took the original developer a long time to build.

The deeper structural issue is that plugin update notifications function as an implicit trust signal. Users see "update available" and click without questioning whether the author is still the same person. A package signing and transfer transparency system similar to what npm has been working toward would help here, but the WordPress ecosystem has historically moved slowly on security infrastructure.

I really wish that the FAIR package manager project had been successful, but they recently gave up after the WordPress drama died down.

https://fair.pm/

FAIR has a very interesting architecture, inspired by atproto, that I think has the potential to mitigate some of the supply-chain attacks we've seen recently.

In FAIR, there's no central package repository. Anyone can run one, like an atproto PDS. Packages have DIDs, routable across all repositories. There are aggregators that provide search, front-ends, etc. And like Bluesky, there are "labelers", separate from repositories and front-ends. So organizations like Socket, etc can label packages with their analysis in a first class way, visible to the whole ecosystem.

So you could set up your installer to ban packages flagged by Socket, or ones that recently published by a new DID, etc. You could run your own labeler with AI security analysis on the packages you care about. A specific community could build their own lint rules and label based on that (like e18e in the npm ecosystem.

Not perfect, but far better than centralized package managers that only get the features their owner decides to pay for.

I think the main problem here is the ideology of software updating. Updates represent a tradeoff: On one hand there might be security vulnerabilities that need an update to fix, and developers don't want to receive bug reports or maintain server infrastructure for obsolete versions. On the other hand, the developer might make decisions users don't want, or turn evil temporarily (as in a supply chain attack) or permanently (as in selling off control of a Wordpress extension).

In the case of small Wordpress extensions from individual developers, I think the tradeoff is such that you should basically never allow auto-updating. Unfortunately wordpress.org runs a Wordpress extension marketplace that doesn't work that way, and worse. I think that other than a small number of high-visibility long-established extensions, you should basically never install anything from there, and if you want a Wordpress extension you should download its source code and install it manually as an unpacked extension.

(This is a comment that I wrote about Chrome extensions, where I replaced Chrome with Wordpress, deleted one sentence about Google, and it was all still true. https://news.ycombinator.com/item?id=47721946#47724474 )

It seems obvious to me that there should now be a concerted and open effort to detect malware in supply chains based on AI-based scanning. Sure, there will be an arms race in malware obfuscation, but that was coming anyway. Manual review is useless at this scale - it is just not happening.

Hear me out. Mergers and acquisitions that substantially lesson market competition can be blocked by governments, or even require approval in certain jurisdictions. https://en.wikipedia.org/wiki/Mergers_and_acquisitions

Maybe mergers or acquisitions that substantially impact security should require approval by marketplaces (industry governance), and notification and approval by even governments?

> In 2017, a buyer using the alias “Daley Tias” purchased the Display Widgets plugin (200,000 installs) for $15,000 and injected payday loan spam.

Is that it? Going through all that trouble just for some spam? Surely more lucrative criminal actions can be imagined with a compromised WP plugin?

If the plugins were bought for six figures, then it must be incredibly lucrative. How on earth could they be making it back? Is injecting spam into Google results THAT lucrative?

I don't think companies appreciated just how much they gave up when they outsourced "IT".

This is probably a controversial opinion but this case is yet another example of why it should be prohibited to sell repositories and storefronts. If you want to take over someone else’s user base you should be forced to display a message to the users and actively ask them whether they trust the new owner as well. Simply passing the whole thing on to someone else in secret who could then compromise the WordPress plugin, a browser extension or something similar should not be allowed.

So how was this attack gonna generate "revenue" for the attacker? What kind of info did they get hold of?

A tale as old as time. And hard to defend against. Did the sellers know their plugins were going to be abused? Is there some kind of seller liability in cases like this?

At this point im not sure how we can reestablish trust in the software supply chain, especailly for small businesses.

Crypto has single handedly created a very large malware industry and has also made information security a massive industry.

Ban crypto and both industries will become way, way smaller.

One of the best time for Cloudflare to market EmDash as Wordpress alternative.

What’s scary is that this attack doesn’t require any technical sophistication. You don’t need zero-days, you don’t need exploits — you just need money. Feels like we’ve shifted from “can you break in?” to “can you buy your way in?”, which is a very different problem.

WordPress was great because of the plugins.

WordPress is now a dangerous ecosystem because of the plugins and their current security model.

I moved to Hugo and encourage others to do so - https://ashishb.net/tech/wordpress-to-hugo/

This looks to be more than just a security bug and rather an incentive problem because you can buy trust with plugin installs numbers and reputation but there’s no mechanism to reprice that trust after the ownership gets changed so the attackers just buy the distribution and monetize it later and that makes this kind of attack economically rational, so it gets reproduced often

This somehow reminds me of the irony that was Secure Custom Fields:

https://news.ycombinator.com/item?id=41821336

One interesting note is the plugins were acquired on Flippa, which is a general marketplace to buy/sell software businesses, not limited to WP plugins.

What I worry about are the long tail of indie apps/extensions/plugins that can get acquired under good intentions and then weaponized. These apps are probably worth more to a threat actor than someone who wants to operate the business genuinely.

Personally, I've found that nowadays the README.md file of most projects is more useful than the code. With the code I inherit their dependency chain and all of that. But with an LLM I can rewrite most of these things myself. This is not yet to the degree of universality. For instance I still use ratatui, but I also don't use a worktree manager or a Claude coordinator from other people - I just have my own. I also don't use OpenClaw - I have my own.

Looking at the list of plugins, I'd probably write accordion-and-accordion-slider and so on myself (meaning Claude Code and Codex would do most of the work). I think the future of software is like that: there is no reason to use most dependencies and so we'll likely tend towards our own library of software, with the web of trust unnecessary because all we need are other people's ideas, not their software.

Deno can whitelist outbound connections to certain hosts or refuse them altogether. If the average backend service is locked down this way, will the supply chain economy survive?

It's been a while, but what struck me about Wordpress plugins is how many have almost no value add over the "manual" way, even ignoring the security aspect. Like wrappers around Stripe.

With AI, I have a hard time thinking wordpress needs to exist anymore. I used to be a huge huge fan.

Interesting perspective. Feels like AI-assisted development is powerful, but without structure it can quickly become messy.

Presumably, Wordpress knows more about the identity of the buyer and will initiate legal action against them... right?

Is it my imagination, or have supply chain attacks like this been becoming increasingly frequent since the xz incident?

Wordpress has always been a backdoor with and without plugins.

Same day that I submit my own plug-in :( hopefully doesn't interfere with anything.

So how should everyday users attempt to avoid this risk? And how to stay vigilant?

The guy probably owns like 4,000 of these plugins and has factored in that 5% will get caught per year and makes bank from the rest of them.

Ah WordPress, the ever growing security nightmare

Rinse repeat. Same thing happens with plugins.

Legal questions...

In browser plugins and mobile apps (and maybe WordPress plugins?), it's pretty well known that malware attackers buying those is a frequent thing, and a serious threat. So:

1. So is there an argument to be made that a developer/publisher/marketplace selling such software, after it has established a reputation and an installed base, may have an obligation to make some level of effort not to sell out their users to malware/criminals?

2. Do we already have some parties developing software with the intention of selling it to malware/criminals, planning that selling it will insulate them from being considered a co-conspirator or accessory?

Do browser extensions next…

deno is good for unkwon code

I mean, WordPress kets getting compromised left and right.

It begs the question, who is at faulty here??

I would never run a piece of software that either itself gets compromised or the tons of plugins it sometimes depends on.

All my sites got pwned through this. Attempts to restore from backup just got pwned again in minutes. Ended up using Claude to create static sites from the database and the assets.

I'm never using Wordpress again and I strongly suggest nobody else does either.

Accepting unknown packages is just another form of vibe coding.

Couldn’t happen to a more technically deserving CMS.

I can foresee a modern code-signing regimen with paid gatekeepers coming to mitigate the risk of supply chain attacks. Imagine the purported strength of mythos automating scans of PRs or releases with some manner of indelible and traceable certification. There's some industrious company - a modern verisign of old - that will attempt to drop in a layer of $250-500 per year fees for that service, capture the app stores to require it. Call me a cynical bastard, but "I was there, Gandalf".

Was it Automattic again?

Well - that kind of shows that WordPress is still popular. :)

I see a future where there are LLM vetted repos for Java, Python, Go, etc... And it will cost $1 to submit a release candidate (even for open source)

edit: The idea is the $1 goes towards the tokens required to scan the source code by an LLM, not simply cost a dollar for no other reason that raising the bar.

First submission is full code scan, incremental releases the scanner focuses on the diffs.

This is interesting, because not only was this not a hack (someone bought the plugin and changed its operation), it's something that would be solved by a separate solution I have to security vulnerabilities in general.

A software building code could provide a legal framework to hold someone liable for transferring ownership of a software product and significantly altering its operation without informing its users. This is a serious issue for any product that depends on another product to ensure safety, privacy, financial impact, etc. It could add additional protections like requiring that cryptographic signature keys be rotated for new owners, or a 30-day warning period where users are given a heads up about the change in ownership or significant operation of the product. Or it could require architectural "bulkheads" that prevent an outside piece of software from compromising the entire thing (requiring a redesign of flawed software). The point of all this would be to prevent a similar attack in the future that might otherwise be legal.

But why a software building code? Aren't building codes slow and annoying and expensive? Isn't it impossible to make a good regulation? Shouldn't we be moving faster and cheaper? Why should I care?

You should care about a building code, because:

1. These major compromises are getting easier, not harder. Tech is big business, and it isn't slowing down, it's ramping up. AI makes attacks easier, and attackers see it's working, so they are more emboldened. Plus, cyber warfare is now the cheaper, more effective way to disrupt operations overseas, without launching a drone or missile, and often without a trace.

2. All of the attacks lately have been preventable. They all rely on people not securing their stacks and workflows. There's no new cutting-edge technology required; you just need to follow the security guidelines that security wonks have been going on and on about for a decade.

3. Nobody is going to secure their stack until you force them to. The physical realm we occupy will never magically make people spontaneously want to do more effort and take more time just to prevent a potential attack at some random point in the future. If it's optional, and more effort, it will be avoided, every time. "The Industry" has had decades to create "industry" solutions to this, and not only haven't they done this, the industry's track record is getting worse.

4. The only thing that will stop these attacks is if you create a consequence for not preventing them. That's what the building code does. Hold people accountable with a code in law. Then they will finally take the extra time and money necessary to secure their shit.

5. The building code does not have to be super hard, or perfect. It just has to be better than what we have now. That's a very low bar. It will be improved over time, like the physical world's building code, fire code, electrical code, health & safety code, etc. It will prevent the easily preventable, standardize common practice, and hold people accountable for unnecessarily putting everyone at risk.

I keep saying it again and again. I get downvoted every time, but I don't care. I'll keep saying it and saying it, until eventually, years from now, somebody who needs to hear it, will hear it.

[dead]

[dead]

[dead]

[dead]

[dead]

[dead]

[dead]

[dead]

The fun part is that Google Safebrowsing doesn't even flag the malicious company's website.

And on their pricing page they offer all plugins as a bundle for 0 USD per year! What a steal! /s

Don't click on this, I would assume it may contain malware: https://essentialplugin[.]com/pricing/

[flagged]

[flagged]

[flagged]

[flagged]