←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 1 comments | 08 Sep 25 15:37 UTC | HN request time: 0.231s | source
Show context
joaomoreno ◴[08 Sep 25 16:49 UTC] No.45170585[source]▶
From sindresorhus:

You can run the following to check if you have the malware in your dependency tree:

`rg -u --max-columns=80 _0x112fa8`

Requires ripgrep:

`brew install rg`

https://github.com/chalk/chalk/issues/656#issuecomment-32668...

replies(8): >>45171142 #>>45171275 #>>45171304 #>>45171841 #>>45172110 #>>45172189 #>>45174730 #>>45175821 #
yifanl ◴[08 Sep 25 18:47 UTC] No.45172189[source]▶
Asking people to run random install scripts just feels very out of place given the context.
replies(2): >>45172767 #>>45174960 #
1. justusthane ◴[08 Sep 25 22:32 UTC] No.45174960[source]▶
ripgrep is quite well known. It’s not some obscure tool. Brew is a well-established package manager.

(I get that the same can be said for said for npm and the packages in question, but I don’t really see how the context of the thread matters in this case).