Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

github.com

Post reply on HN
Print view View original

41–50 of 296 posts

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#41

Post by koakuma-chan »

nodesocket wrote: post #40
koakuma-chan wrote: post #35

Earlier quoted context omitted.

I have two yubikeys lying around, how do I use them? I don't even have the correct hole in my laptop or in my phone to insert them

This is a joke right? Can’t say I’ve ever heard of USB ports referred to as “holes”.

No I'm serious. I used to work on a PC and I had the correct hole, but I never figured out how to make yubikey useful and of course I couldn't use it with my phone. Maybe I'm missing something?

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#42

Post by diggan »

skeeter2020 wrote: post #25
diggan wrote: post #12

So far, it seems to be a bog-standard phishing email, with not much novelty or sophistication, seems the people running the operation got very lucky with their victims though. I'm starting to think we haven't even seen the full scope of it yet, two authors confirmed as compromised, must be 10+ out there we haven't heard of yet?

>> So far, it seems to be a bog-standard phishing email The fact this is NOT the standard phishing email shows how low the bar is: 1. the text of the email reads like one you'd get from npm in the tone, format and lack of obvious spelling & grammatical errors. It pushes you to move quicker than you might normally, without triggering the typical suspicions. 2. the landing domain and website copy seem really close to l…

Both of those points are fairly common in phishing emails, at least the ones I receive. Cloning the HTML/CSS for phishing has been done for as long as I've been able to receive emails, don't even need LLMs for that :)

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#43

Post by BenjiWiebe »

koakuma-chan wrote: post #35
nodesocket wrote: post #34

Earlier quoted context omitted.

I think just supporting yubikeys is sufficient.

I have two yubikeys lying around, how do I use them? I don't even have the correct hole in my laptop or in my phone to insert them

You can use an adapter (usb-a to usb-c). Or are they NFC capable? Some models are.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#44

Post by IshKebab »

diggan wrote: post #12

So far, it seems to be a bog-standard phishing email, with not much novelty or sophistication, seems the people running the operation got very lucky with their victims though. I'm starting to think we haven't even seen the full scope of it yet, two authors confirmed as compromised, must be 10+ out there we haven't heard of yet?

Probably the differentiating factor here is that the phishing message was very plausible. Normally they're full of spelling mistakes and unprofessional grammar. The domain was also plausible.

I think where they got lucky is

> In hindsight, the fact that his browser did not auto-complete the login should have been a red flag.

A huge red flag. I wonder if browsers should actually detect if you're putting login details for site A manually into site B, and give you a "are you sure this isn't phishing" warning or something?

I don't quite understand how the chalk author fell for it though. They said

> This was mobile, I don't use browser extensions for the password manager there.

So are there mobile password managers that don't even check the URL? I dunno how that works...

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#45

Post by diggan »

koakuma-chan wrote: post #33
diggan wrote: post #30

Earlier quoted context omitted.

Use a password manager (that isn't too buggy and/or suck) and you get the same thing for both TOTP and passwords.

Npm can't force people to use password manager

Nor does TOTP+password lock you to one authentication provider indefinitely. Tradeoffs :)

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#46

Post by koakuma-chan »

nodesocket wrote: post #40
koakuma-chan wrote: post #35

Earlier quoted context omitted.

I have two yubikeys lying around, how do I use them? I don't even have the correct hole in my laptop or in my phone to insert them

This is a joke right? Can’t say I’ve ever heard of USB ports referred to as “holes”.

> Can’t say I’ve ever heard of USB ports referred to as “holes”.

I cannot be bother to remember every hole name. They're all USB anyway, the difference is that some are A, C, or Lightning, I bought a new MacBook and it has that magnet hole, what is that called? I'm not following.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#47

Post by ljlolel »

koakuma-chan wrote: post #33
diggan wrote: post #30

Earlier quoted context omitted.

Use a password manager (that isn't too buggy and/or suck) and you get the same thing for both TOTP and passwords.

Npm can't force people to use password manager

You can if you just force passwords longer than people can memorize or even want to write down (assigned 24+ characters)

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#48

Post by nodesocket »

KevinMS wrote: post #39
nodesocket wrote: post #34

Earlier quoted context omitted.

I think just supporting yubikeys is sufficient.

yubikeys locks up my firefox on both windows and mac, no thanks

Mine works flawlessly in Chrome on MacOS. Maybe you got defective one, or try factory resetting it.

Re: DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

#49

Post by koakuma-chan »

ljlolel wrote: post #47
koakuma-chan wrote: post #33

Earlier quoted context omitted.

Npm can't force people to use password manager

You can if you just force passwords longer than people can memorize or even want to write down (assigned 24+ characters)

It's just gonna be on a sticky note hanging on the screen or under keyboard
Post reply on HN