351–360 of 796 posts
Earlier quoted context omitted.
Perfect example of why habituating users to renewing credentials (typically password expiration) is a terrible practice.
is there an actual habituation? that message feels like it could work as a first-time as well
Earlier quoted context omitted.
TIL: I need to fix my CI pipeline. Gonna create a jira ticket I guess… Thank you!
Sorry, I had assumed this was what you were doing when I wrote my question but I should have specified. And sorry for now making your npm install step twice as long! ;)
Earlier quoted context omitted.
I'm a little confused on one of the excerpts from your article. > Our package-lock.json specified the stable version 1.3.2 or newer, so it installed the latest version 1.3.3 As far as I've always understood, the lockfile always specifies one single, locked version for each dependency, and even provides the URL to the tarball of that version. You can define "x version or newer" in the package.json file, but if it upda…
As others have noted, npm install can/will change your lockfile as it installs, and one caveat for the clean-install command they provide is that it is SLOW, since it deletes the entire node_modules directory. Lots of people have complained but they have done nothing: https://github.com/npm/cli/issues/564 The npm team eventually seemed to settle on requiring someone to bring an RFC for this improvment, and the RFC so…
NPM deserves some blame here, IMO. Countless third party intel feeds and security startups can apparently detect this malicious activity, yet NPM, the single source of truth for these packages, with access to literally every data event and security signal, can't seem to stop falling victim to this type of attack? It's practically willful ignorance at this point.
NPM is owned by GitHub and therefore Microsoft, who is too busy putting in Copilot into apps that have 0 reason to have any form of generative AI in them
Earlier quoted context omitted.
Sorry, I am unfamiliar with ripgrep. Is this simply scanning for the string `_0x112fa8`? Could we do the same thing with normal grep -r?
yes. ripgrep just does it faster, is all.
For security checks, the first 2 out of 3 is just fine.
Earlier quoted context omitted.
Yo, someone at npm needs to unpublish simple-swizzle@0.2.3 IMMEDIATELY. It’s still actively compromised.
It's been almost two hours without a single email back from npm. I am sitting here struggling to figure out what to do to fix any of this. The packages that have Sindre as a co-publisher have been published over but even he isn't able to yank the malicious versions AFAIU. If there's any ideas on what I should be doing, I'm all ears. EDIT: I've heard back, they said they're aware and are on it, but no further details.
It took them quite a long time to do so.
Finally validated for writing my own damn ANSI escape codes.
Earlier quoted context omitted.
Or the language is too braindead. `is-arrayish` should not even have to be a thing.
I agree that it doesn't need to exist, but as far as I can tell, almost no one depends on it directly. The only person using it is the author, who uses it in some other small libraries, which are then used in a larger, nontrivial library. I just created a Next.js app, saw that `is-arrayish` was in my node_modules, and tried to figure out how it got there and why. Here's the chain of dependencies: next > sharp > color…
Earlier quoted context omitted.
Can you attribute this technique to a specific group?
Almost certainly Lazarus
"we kindly ask that you complete this update your earliest convenience".
The email was included here: https://cdn.prod.website-files.com/642adcaf364024654c71df23/...
From this article: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com...
