ESLint compromised, may have stolen your credentials

Re:ESLint compromised, may have stolen your credentials by andrew_ on Thursday July 12, 2018 @09:24AM (#17514195)

This was resolved in about an hour, looking at the issue linked. All things considered, that's great turn-around time for a fix.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by mrob on Thursday July 12, 2018 @09:27AM (#17514223)

It's not completely resolved until everybody who was potentially compromised audits everything their credentials gave them control over and changes the credentials.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by andrew_ on Thursday July 12, 2018 @09:32AM (#17514285)

Is a bug not fully resolved until every machine on the planet running that software has upgraded to a version in which the bug doesn't exist? That'd be quite a silly assertion imho.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by lsadam0 on Thursday July 12, 2018 @09:43AM (#17514433)

I mean sure, the turn-around time is great...but how did this pass review in the first place? This should never happen in a reasonably managed project.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by andrew_ on Thursday July 12, 2018 @09:45AM (#17514455)

It wasn't up for review. It was published out of band, and outside of the ESLint pipeline using likely stolen credentials. That's how that stuff sneaks in.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by lsadam0 on Thursday July 12, 2018 @09:48AM (#17514487)

Ah, thanks for the clarification. At first I thought this made it through the actual release process.

[ Parent | on HN ]