[deleted]
NPM debug and chalk packages compromised
71–80 of 796 posts
Re: NPM debug and chalk packages compromised
#72Earlier quoted context omitted.
Which of these would you prefer to reimplement? Debug, chalk, ansi-styles? --- You can pretend like this is unique to JS ecosystem, but xz was compromised for 3 years.
I wouldn't use debug or ansi-styles. They're not even remotely close to being worth adding a dependency. Obviously none of them are trustworthy now though.
I wouldn’t even use chalk. Altering terminal output is easy. But it should be used sparingly.
Re: NPM debug and chalk packages compromised
#73Earlier quoted context omitted.
Ignore anything coming from npm you didn't expect. Don't click links, go to the website directly and address it there. That's what I should have done, and didn't because I was in a rush. Don't do security things when you're not fully awake, too. Lesson learned. The email was a "2FA update" email telling me it's been 12 months since I updated 2FA. That should have been a red flag but I've seen similarly dumb things co…
I see (I think): they tricked you into entering a TOTP code into their site, which they then proxied to the real names, thereby authenticating as your account. Is that correct?
It only proves that TOTP is useless against phishing.
Re: NPM debug and chalk packages compromised
#74Definitely sounds like spear phishing targeting you specifically.
Kudos to you for owning up to it.
As others have said, it's the kind of thing that could happen to anyone, unfortunately.
Re: NPM debug and chalk packages compromised
#75Given that most of these kind of attacks are detected relatively quickly, NPM should implement a feature where it doesn't install/upgrade packages newer than 3 days, and just use the previous version.
What if the latest patch is (claiming to be) a security fix? Then that's 3 days of more insecurity.
Re: NPM debug and chalk packages compromised
#76A super quick script to check the deps in your package-lock.json file is here[0]. [0]: https://gist.github.com/martypitt/0d50c350aa7f0fc73354754343...
aren't these already nuked and show up in the "npm audit" command?
Re: NPM debug and chalk packages compromised
#77Earlier quoted context omitted.
Lack of a good batteries-included stdlib. You're either importing a ton of little dependencies (which then depend on other small libraries) or you end up writing a ton of really basic functionality yourself.
But why can’t we have a good library instead of those mini thingies?
Because a mini thing can be written in mini time by a mini number of people
Re: NPM debug and chalk packages compromised
#78BTW: the NPM logo is blurry in that phishing email.
Re: NPM debug and chalk packages compromised
#79Earlier quoted context omitted.
What did the phishing email say that made you click and login?
That it had been more than 12 months since last updating them. Npm has done outreach before about doing security changes/enhancements in the past so this didn't really catch me. Screenshot here: https://imgur.com/a/q8s235k
Yikes, looks legit. Curious what are the destination addresses? Would like to monitor them to see how much coin they are stealing.
Re: NPM debug and chalk packages compromised
#80For everyone wondering: the code looks this way: https://web.archive.org/web/20250908162250/https://cdn.jsdel...
Got it from the "simple-swizzle" package that hasn't been taken down by NPM.