miniblog.

It's fascinating to see the adversarial relationship between the developers of Incognito Mode and those trying to detect it. JS is a very rich environment with a ton of options. https://www.bleepingcomputer.com/news/google/google-chrome-incognito-mode-can-still-be-detected-by-these-methods/

A remarkable new scam: buy a smartphone app, record user interactions, and replay them with bots to fraudulently increase ad clicks and therefore revenue! https://www.buzzfeednews.com/article/craigsilverman/how-a-massive-ad-fraud-scheme-exploited-android-phones-to Seems very hard to detect, as it's using real user data to make bots appear human.

If you someone made a concerted effort to put malware in a low level npm package, how hard would it be to detect? Worryingly, it would be really difficult.