Hacker News new | past | comments | ask | show | jobs | submit login
IRS-authorized eFile.com tax return software caught serving JavaScript malware (bleepingcomputer.com)
46 points by el_duderino on April 4, 2023 | hide | past | favorite | 24 comments



Hmm they said that the malware came from a JS file called 'popper.js' and looking at their site it looks like they are using Bootstrap. Based on this sounds like a supply chain attack.


I’m honestly surprised this sort of thing doesn’t happen more often.

One of the fastest ways to monetize an open source software package is to sell your GitHub login to a bad actor or put malware in it yourself.

It would be extremely easy for a state level actor to compromise an npm dependency through bribery or blackmail.


Popper.js maintainer here, we haven't been compromised. They just injected the malware in that position but the malware didn't come from our npm release


You already know what I owe or don't owe. Send me a bill in the mail. Americans are generous givers. The reason they hate taxation is because you've made the average person equate taxes with unnecessary gamesmanship and one side honesty. If taxes were simplified, Americans would be willing to pay more. They'd gladly give the yearly cost of their tax prep to be free of the burden.


But how will Intuit make money for their TurboTax software and how will Congress people get their donations from Intuit? Won't someone please think of the mega corporations!?


Tax law also needs to be complicated to hide all the loopholes used by the wealthy to avoid taxes altogether.

What we desperately need is a hard reset of the tax code. Simple straightforward progressive tax brackets with no deductions whatsoever. If I overpaid send me a check. If I underpaid send me a bill.


Also, these eFile middlemen/providers "deserve" their cut of fees to make profits for all the hard work they do taking credit card payments and moving funds into Federal bank accounts. It's very hard work, I'm sure.


>You already know what I owe or don't owe.

No, they don't. They don't know if you acquired a dependent or lost one. They don't know if you are entitled to an EV credit. They don't know if you are landlord with rental income and expenses. They don't know if you donated to charity. The list goes on and on.

> If taxes were simplified, Americans would be willing to pay more

Any support for that claim?


> They don't know if you acquired a dependent or lost one.

In many cases they do. Births need to be certified at the time. Adoptions and fosters and guardianships have their own paperwork that needs to be filed and sometimes court time. Deaths need to be certified at the time.

> They don't know if you are entitled to an EV credit.

Cars need to be registered and plated.

> They don't know if you are landlord with rental income and expenses.

Landlords can already setup income tax disclosure and withholding on rentals at the time of accrual, just about the same as any other job. It doesn't need to be an "April surprise" non-withheld lump sum to the IRS (and it probably shouldn't ever be, but I'm not your CPA). Expense-related tax credits are certainly a complication, but that's probably tax credits that should be simplified anyway. If it was desired to keep them, it would probably make sense to report them as frequently and as timely as income tax withholding is allowed to be.

The only real complication to most of the above is that in the current US federal system a lot of the data is state-managed (birth/death certificates, car registrations, etc) and there'd need to be some way to, uh, federate that data in a safe way. But some of that data already needs to be "federated" anyway (SSNs key off of birth certificates).


>a lot of the data is state-managed (birth/death certificates, car registrations, etc)

That is a huge, currently insurmountable problem. The states are not likely to just roll over and kow tow to new, intrusive federal tax laws, look at the history of ACA (Obamacare).

Further, you don't seem to understand the requirements to be claimed as a dependent. Simply being the birth parent is only one small part, it also requires among other things a determination of residency household and who pays for support. There are a non-trivial number of tax returns filed which falsely claim a dependent (either deliberately or through ignorance), which then causes a lot of grief and delay for the taxpayer who is actually entitled to so claim.

And there are more requirements to claim an EV credit beyond simply the registration.

I note you didn't respond to the item about charitable donations. I could provide another twenty items that the IRS doesn't know enough about until you tell them if I wanted to take the time, and that still wouldn't be an exhaustive list.


I filed charitable donations under the same bucket as "expenses". It's a complicated tax credit that the tax code could potentially simplify or streamline. It's another one of those "dual reporting" situations where the charity also need to report it to the IRS as their income so there are some obvious ways to streamline/simplify by combining the filing if nothing else.

In general, I feel like you are using the existing baroque complexity of the tax code as the reason not to simplify it. Of course that is a Catch-22! The above sentiment that the IRS "could just tell us what we owe" is a desire to simplify at its core. Other countries have simplified their tax codes to the point where they just automatically send a bill or a check and a sign-off of pre-completed forms. You are right, that's not possible with the complexity of today's US tax codes, but it is defeatist to suggest that the complexity of today's tax codes are unchangeable laws handed down from the stars that can't be simplified so that we could get the nice things that other countries have today (and that for-profit corporations like Intuit spend lots of money lobbying Congress telling them that Americans don't deserve such nice things).


>using the existing baroque complexity of the tax code as the reason not to simplify it.

One huge challenge is the fact that a lot of welfare is embedded into the system as tax credits. That is why it is so complicated to be sure the correct taxpayer gets to claim a child, since the credits amount to potentially many thousands of dollars. If this welfare money instead was delivered directly instead of via tax credits, then yes a lot of the complexity could be removed, but it's been this way so long, there is a lot of inertia.


Tax credits are not and cannot ever be actual welfare if they aren't money in hand. There's definitely a "wish it was welfare" aspect to many of the tax credits in that they supposedly help groups like families (and, uh, corporations) get a lower tax rate, but most tax credits really are just an indication that the base tax rates aren't correctly-sized versus societal needs and could be deeply simplified.

There is indeed a lot of inertia from the "wish it was welfare" feeling giving a lot of reasons for people (and corporations, lol) to claw for keeping many of the tax credits in play because it does save them money in a noticeable way to their bottom line that also makes them feel like they "deserve it" (for "hard work" or other "earned" reasons) and that could be greatly simplified indeed by, I don't know, maybe correctly investing in real welfare projects instead.


> Tax credits are not and cannot ever be actual welfare if they aren’t money in hand.

Refundable tax credits are money in hand. (They may be delayed money in hand, but effectively that’s just welfare with eligibility determined with a lag, which is fairly common, though the lag for tax credits is longer than for most other welfare programs.)

But the main “welfare-like” tax credit (EITC) is also advanceable (via the W-5 process) as well as refundable, which removes the delayed aspect, too.


The tax authority doesn’t know if you’re a landlord? That hard to believe.


Suppose I make your acquaintance and end up renting my second home to you starting next month. How would the IRS know anything about that?

Even if they know I was a landlord in a prior year, they still have no way to know how much rent I received during the year, or what my expenses were.


Because you have a contract, and that contract would be registered? And if you don’t have a contract, that’s a recipe for abuse of rights and tax evasion.


There is no requirement to have a written contract with a tenant, or to register it with anyone, to be a landlord. The IRS in fact never asks and does not know the identity of your tenants.


> There is no requirement to have a written contract with a tenant

Sounds horrific

> The IRS in fact never asks and does not know the identity of your tenants.

Why is that a requirement to registering a contract? You’re just registering the rent, address and length.


Here are a couple of very recent ISC SANS posts on the issue:

Supply Chain Compromise or False Positive: The Intriguing Case of efile.com [updated - confirmed malicious code] - https://isc.sans.edu/diary/Supply+Chain+Compromise+or+False+...

Analyzing the efile.com Malware "efail" - https://isc.sans.edu/diary/Analyzing+the+efilecom+Malware+ef...

edit: Of course I rushed to post this comment before actually looking at the linked story. The story links and credits one of these posts.


>Note, this security incident specifically concerns eFile.com and not identical sounding domains or IRS' e-file infrastructure.

What exactly does the author think "IRS-authorized" means?


The author here. The name eFile(.)com is bound to confuse some readers who may mistake it for IRS' e-file system/API. Probably why the company chose that brand name (SEO or whatever). IRS-authorised software providers (who need to apply and get certified https://www.irs.gov/e-file-providers/become-an-authorized-e-... ) include those who can have taxpayers use their software to e-file returns to the IRS. These also include Intuit's TurboTax.

Anyway, there's that and confusing domain names likes like e-file(.com) that have got nothing to do with the concerned efile(.com) or the IRS, hence that note.

Other media outlets (e.g. https://www.pcworld.com/article/1682428/irs-certified-free-t... ) have put similar disclaimers in place for the avoidance of doubt: "(which is a separate, for-profit tax company, despite the identical name to IRS eFile)."

Thanks for noticing.


Probably means authorized by the IRS in some way, either as a stamp of approval or specifically authorized to use some sort of e-file api.


looks at Intuit




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: