551–560 of 796 posts
Yeah I know "everyone can be pwned" etc. but at this point if you are not using a password manager and still entering passwords on random websites whose domains don't match the official one then you have no business doing anything of value on the internet.
How does someone intelligent with 2FA get pwned? Serious question.
Earlier quoted context omitted.
You're right. I only looked at the source for debug and ansi-styles. After looking at chalk it's insanity to add that as a dependency as well.
And yet it has 300M weekly downloads. I am fairly sure that most of these are not because it is a direct dependency of people's projects, but rather it is a dependency of a dependency of a dependency.
This is really scary. It could have totally happened to me too. How can we design security which works even when people are tired or stressed? Once upon a time, I used a software called passwordmaker. Essentially, it computed a password like hash(domain+username+master password). Genius idea, but it was a nightmare to use. Why? Because amazon.se and amazon.com share the same username/password database. Similarly, the…
Passkeys already solve for this, we just have to get past the FUD.
Here we are again. 12 days ago ( https://news.ycombinator.com/item?id=45039764 ) I commented how a similar compromise of Nx was totally preventable. Again, this is not the failure of a single person. This is a failure of the software industry . Supply chain attacks have gigantic impacts. Yet these are all solved problems. Somebody has to just implement the standard security measures that prevents these compromises. W…
I don't disagree, but this sentence is doing a lot of heavy lifting. See also "draw the rest of the owl".
Earlier quoted context omitted.
So how do you detect these attacks?
We use a mix of static analysis and AI. Flagged packages are escalated to a human review team. If we catch a malicious package, we notify our users, block installation and report them to the upstream package registries. Suspected malicious packages that have not yet been reviewed by a human are blocked for our users, but we don't try to get them removed until after they have been triaged by a human. In this incident,…
Earlier quoted context omitted.
Hey, you're doing an exemplary response, transparent and fast, in what must be a very stressful situation! I figure you aren't about to get fooled by phishing anytime soon, but based on some of your remarks and remarks of others, a PSA: TRUSTING YOUR OWN SENSES to "check" that a domain is right, or an email is right, or the wording has some urgency or whatever is BOUND TO FAIL often enough. I don't understand how mos…
Or you know, get a password manager like the rest of us. If your password manager doesn't show the usual autofill, since the domain is different than it should, take a step back and validate everything before moving on. Have the TOTP in the same/another password manager (after considering the tradeoffs) and that can also not be entered unless the domain is right :)
Passkeys seem like the best solution here where you physically can not fall for a phishing attack.
Earlier quoted context omitted.
npmjs is the stdlib, or what emerged from it. It started as CommonJs ([1]) with Server-side JavaScript (SSJS) runtimes like Helma, v8cgi, etc. before node.js even existed but then was soon totally dominated by node.js. The history of Server-side JavaScript btw is even longer than Java on the server side, starting with Netscape's LifeScript in 1996 I believe. Apart from the module-loading spec, the CommonJs initiative…
> TypeScripters who need big daddy MS or other monopolist to sort it all out for them What is this crap statement? So you want type-checking because it helps you catch a class of errors in an automated way, and suddenly you have a daddy complex and like monopolies? Claiming this says a lot more about you than people who use TypeScript.
Earlier quoted context omitted.
I'll bet they don't. There's way to much churn for it all to be checked
Churn? On Debian? It takes like 2 years to get up to date packages. This isn't NPM.
Earlier quoted context omitted.
That was the low-tech part of their attack, and was my fault - both for clicking on it and for my phrasing. It wasn't a single-click attack, sorry for the confusion. I logged into their fake site with a TOTP code.
This is a clear example that this can happen to anyone. Sorry for what you're going through.
Earlier quoted context omitted.
We also caught this right away at Socket, https://socket.dev/blog/npm-author-qix-compromised-in-major-... While it sucks that this happened, the good thing is that the ecosystem mobilized quickly. I think these sorts of incidents really show why package scanning is essential for securing open source package repositories.
[flagged]
It seems strange to attack a service like this right after it actively helped keep people safe from malware. I'm sure its not perfect, but it sounds like they deserve to take a victory lap.