Preliminary research
Hack the Source, Of the Source
AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.
A talk on hacking package registries by chaining parser differentials with injection. A LuaJIT-vs-Lua integer differential makes server and client resolve different versions; Julia's Registrator falls to command and argument injection via git rev-parse and clone --upload-pack, reached via a backslash API path traversal returning a controlled clone_url for RCE; a NuGet nuspec-selection inconsistency poisons the registration blob; and CocoaPods session tokens fall to a birthday attack.
Record
- Researcher
- Tsi-Lin Ng
- Published by
- i.blackhat.com
- Format
- Whitepaper
- Topic
- Other
In the archive
Related sources
- Born Corrupted Whitepaper
Tags
This page is the archive's own catalogue record. The research is the work of Tsi-Lin Ng, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .