571–580 of 796 posts
Earlier quoted context omitted.
I would agree if this were one of those `curl | sh` scenarios, but don't we consider things like `brew` to be sufficiently low-risk, akin to `apt`, `dnf`, and the like?
Anyone can upload an NPM package without much review. For Homebrew, you at least have to submit a pull request.
If you want to see what the phishing site (npmjs[.]help) looks like: https://urlscan.io/result/01992a3e-4f8c-72bb-90a9-c13826f2d8... - Was still up and running 2 hours ago.
Hey, that's a pretty good reproduction of npmjs
Earlier quoted context omitted.
[flagged]
Apparently it found this attack more or less immediately. It seems strange to attack a service like this right after it actively helped keep people safe from malware. I'm sure its not perfect, but it sounds like they deserve to take a victory lap.
Earlier quoted context omitted.
Do I need any? Automated tools cannot prevent malicious code being injected. While they can make attempts to evaluate common heuristics and will catch low hanging malware, they are not fool proof against highly targeted attacks. Either way, the parent post is clearly ambulance chasing rather than having a productive conversation, which should really be about whether or not automatically downloading and executing huge…
> Do I need any? Automated tools cannot prevent malicious code being injected. While they can make attempts to evaluate common heuristics and will catch low hanging malware, they are not fool proof against highly targeted attacks. So just because a lock isn't 100% effective at keeping out criminals we shouldn't lock our doors?
That’s like lock companies parading around when their neighbour is murdered during a burglary but they weren’t because they bought a Foobar(tm) lock.
Earlier quoted context omitted.
How does someone intelligent with 2FA get pwned? Serious question.
Numbers game. Plenty of people got the email and deleted it. Only takes one person distracted and thinking "oh yeah my 2FA is pretty old" for them to get pwned.
Earlier quoted context omitted.
How does someone intelligent with 2FA get pwned? Serious question.
Numbers game. Plenty of people got the email and deleted it. Only takes one person distracted and thinking "oh yeah my 2FA is pretty old" for them to get pwned.
Hi, yep I got pwned. Sorry everyone, very embarrassing. More info: - https://github.com/chalk/chalk/issues/656 - https://github.com/debug-js/debug/issues/1005#issuecomment-3... Affected packages (at least the ones I know of): - ansi-styles@6.2.2 - debug@4.4.2 (appears to have been yanked as of 8 Sep 18:09 CEST) - chalk@5.6.1 - supports-color@10.2.1 - strip-ansi@7.1.1 - ansi-regex@6.2.1 - wrap-ansi@9.0.1 - color-conve…
thanks for your efforts!
Earlier quoted context omitted.
> sometimes the password manager does not auto-fill So pick one that does? That's like its top 2 feature > he does use one He doesn't since he has no autofill installed, so loses the key security+ convenience benefit of automatch
> So pick one that does? That's like its top 2 feature Still doesn’t work 100% of the time, because half of the companies on earth demote their developer time to breaking 1995-level forms. That’s why every popular password manager has a way to fill passwords for other domains, why people learn to use that feature, and why phishers have learned to convince people to use that feature. WebAuthn prevents phishing. Passwo…
Earlier quoted context omitted.
As someone with red/green vision deficiency: if you do this, please don’t forget people like me are unable to distinguish many shades of colours, which would be very disadvantageous here!
It’s not like it would hurt you for there to be supplementary info others can see but you can’t.
From sindresorhus: You can run the following to check if you have the malware in your dependency tree: `rg -u --max-columns=80 _0x112fa8` Requires ripgrep: `brew install rg` https://github.com/chalk/chalk/issues/656#issuecomment-32668...
Here's something I generated in my coding AI for Powershell: `Get-ChildItem -Recurse | Select-String -Pattern '_0x112fa8' | ForEach-Object { $_.Line.Substring(0, [Math]::Min(80, $_.Line.Length)) }` Breakdown of the Command: - Get-ChildItem -Recurse: This command retrieves all files in the current directory and its subdirectories. - Select-String -Pattern '_0x112fa8': This searches for the specified pattern in the fil…