←back to thread

NPM debug and chalk packages compromised

(www.aikido.dev)
1369 points universesquid | 1 comments | 08 Sep 25 15:37 UTC | HN request time: 0.393s | source
Show context
simpaticoder ◴[08 Sep 25 16:41 UTC] No.45170488[source]▶
I've come to the conclusion that avoiding the npm registry is a great benefit. The alternative is to import packages directly from the (git) repository. Apart from being a major vector for supply-chain attacks like this one, it is also true that there is little or no coupling between the source of a project and its published code. The 'npm publish' step takes pushes local contents into the registry, meaning that a malefactor can easily make changes to code before publishing.
replies(5): >>45170843 #>>45171235 #>>45171399 #>>45172081 #>>45175895 #
1. typpilol ◴[09 Sep 25 00:24 UTC] No.45175895[source]▶
You can do some weird verify thing on your GitHub builds now when they publish to npm, but I've noticed you can still publish from elsewhere even with it pegged to a build?

But maybe I'm misunderstanding the feature