←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 2 comments | 08 Sep 25 15:37 UTC | HN request time: 0.718s | source
Show context
paulddraper ◴[08 Sep 25 16:04 UTC] No.45169982[source]▶
Maintainer phished.

Was caught quickly (hours? hard to be sure, the versions have been removed/overwritten).

Attacker owns npmjs.help domain.

replies(1): >>45170159 #
DDerTyp ◴[08 Sep 25 16:18 UTC] No.45170159[source]▶
Noticed that after ten mins, contacted author immediatly and he seems to be working on it / restoring his account / removing malware on published packages.

Kinda "proud" on it haha :D

replies(1): >>45170407 #
1. jbverschoor ◴[08 Sep 25 16:36 UTC] No.45170407[source]▶
Doesn’t npmjs do things like signing, pinning, and yanking packages, like rubygems?
replies(1): >>45172206 #
2. paulddraper ◴[08 Sep 25 18:48 UTC] No.45172206[source]▶
Yes