←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 1 comments | 08 Sep 25 15:37 UTC | HN request time: 0.254s | source
Show context
cddotdotslash ◴[08 Sep 25 17:05 UTC] No.45170804[source]▶
NPM deserves some blame here, IMO. Countless third party intel feeds and security startups can apparently detect this malicious activity, yet NPM, the single source of truth for these packages, with access to literally every data event and security signal, can't seem to stop falling victim to this type of attack? It's practically willful ignorance at this point.
replies(5): >>45170982 #>>45172458 #>>45172566 #>>45173494 #>>45175539 #
PokestarFan ◴[08 Sep 25 17:18 UTC] No.45170982[source]▶
NPM is owned by GitHub and therefore Microsoft, who is too busy putting in Copilot into apps that have 0 reason to have any form of generative AI in them
replies(5): >>45172925 #>>45172926 #>>45173133 #>>45175660 #>>45179454 #
bnchrch ◴[08 Sep 25 19:40 UTC] No.45172926[source]▶
Good god. Not everything has to be about your opinion on AI.
replies(2): >>45173693 #>>45174064 #
1. jay_kyburz ◴[08 Sep 25 20:41 UTC] No.45173693[source]▶
Actually, they could probably use AI to see if each update to a package looks malicious or obfuscated.