It's typical phishing email... and if the author when though any type of cybersecurity training, they would see that the email wasn't that great.
The sense of urgency is always the red flag.
We all dodged a bullet
21–30 of 498 posts
Re: We all dodged a bullet
#22> These kinds of dependencies are everywhere and nobody would even think that they could be harmful. Tons of people think these kind of micro dependencies are harmful and many of them have been saying it for years.
Yeah, there's an entire community dedicated to cleaning up the js ecosystem.
Micro-dependencies are not the only thing that went wrong here, but hopefully this is a wakeup call to do some cleaning.
Re: We all dodged a bullet
#23I know this isn't really possible for smaller guys but larger players (like NPM) really should buy up all the TLD versions of "npm" (that is: npm.io, npm.sh, npm.help, etc). One of the reasons this was so effective is that the attacker managed to snap up "npm.help"
There's like 1500 TLDs, now some of them are restricted and country-code TLDs but now it makes me wonder how much it would actual cost per year to maintain registration of every non-restricted TLD. I'm sure theres some SaaS company that'll do it.
Re: We all dodged a bullet
#24Is there a tool that you can put between your npm client and npm web servers that serves package versions that are month old and possibly also tracks discovered malware and never serves infected versions?
Re: We all dodged a bullet
#25Really feels like these big open packages repos need a better security solution. Or at least a core subset of carefully vetted ones. Same issue with python, rust etc. It’s all very trust driven
In a case like this, the package maintainer's account itself has been hacked, so I'm not sure if that would be meaningful. The only solution would be to prevent all releases from being applied immediately.
A solution could be enforcing hardware keys for 2FA for all maintainers if a package has more than XX thousand weekly downloads.
No hardware keys, no new releases.
Re: We all dodged a bullet
#26Earlier quoted context omitted.
Should be - open another browser window and manually log into npm whatever, and update your 2fa there. Definitely good practice .
This is the Way. To minimize attack surface, the senders of authentic messages should straight-up avoid putting links to "do the thing" in the message. Just tell the user to update their credentials via the website.
That's what the Australian Tax Office does. Just a plaintext message that's effectively "you've got a new message. Go to the website to read it."
Re: We all dodged a bullet
#27Always use password manager to automatically fill in your credentials. If password manager doesn't find your credentials, check the domain. On top of that, you can always go directly to the website, to make any needed changes there, without following the link.
> Always use password manager to automatically fill in your credentials
Absolutely not.
https://www.malwarebytes.com/blog/news/2025/08/clickjack-att...
https://thehackernews.com/2025/08/dom-based-extension-clickj...
https://www.intercede.com/the-dangers-of-password-autofill-a...
Re: We all dodged a bullet
#28>Saved by procrastination!
Seriously, this is one of my key survival mechanisms. By the time I became system administrator for a small services company, I had learned to let other people beta test things. We ran Microsoft Office 2000 for 12 years, and saved soooo many upgrade headaches. We had a decade without the need to retrain.
That, and like other have said... never clicking links in emails.
Re: We all dodged a bullet
#29Dat domain name. Yeah, stop those cute domain names. I never got the memo on Youtu.be, I just had “learn” it was okay. Of course people started to let their guard down because dumbasses started to get cute. We all did dodge a bullet because we’ve been installing stuff from NPM with reckless abandon for awhile. Can anyone give me a reason why this wouldn’t happen in other ecosystems like Python, because I really don’t…
of all people my mortgage servicer is the worst about this. Your login is valid on like 3 different top level domains and you get bounced between them when you sign in, eventually going from servicer.com to myservicer.com to servicer.otherthing.com! It's as though they were training you to not care about domain names.
Re: We all dodged a bullet
#30Really feels like these big open packages repos need a better security solution. Or at least a core subset of carefully vetted ones. Same issue with python, rust etc. It’s all very trust driven
In a case like this, the package maintainer's account itself has been hacked, so I'm not sure if that would be meaningful. The only solution would be to prevent all releases from being applied immediately.
There needs to be a massive push from the larger important packages to eliminate these idiotic transitive dependencies. Core infrastructure shouldn't rely on trivial packages maintained by a single random person from who knows where that can push updates without review. It's absolutely insane.