(www.aikido.dev)

1369 points universesquid | 3 comments | 08 Sep 25 15:37 UTC | HN request time: 0s | source

1. Vincenius ◴[08 Sep 25 16:47 UTC] No.45170550[source]▶

Wow, I also received the same phishing email even though my packages only have a few hundred downloads a week (eg. bsky-embed).

So I guess a lot more accounts/packages might be affected than the ones stated in the article

replies(1): >>45174048 #

2. gaudystead ◴[08 Sep 25 21:10 UTC] No.45174048[source]▶

Did you receive the email in a similar time window? I'm trying to think of ways to scan other repositories for signs of compromise.

replies(1): >>45177368 #

3. Vincenius ◴[09 Sep 25 04:22 UTC] No.45177368[source]▶

Yeah, I received the email on the 8th a little earlier at 2:50am (utc +2)

NPM debug and chalk packages compromised