Re:ESLint compromised, may have stolen your credentials
by fulafel on Thursday July 12, 2018 @09:25AM
(#17514208)
Is it possible that this is a npm virus, or semiautomated train of compromises, and the eslint-scope project npm credentials were compromised the same way? Given it was eval-ing code off pastebin, it's hard to tell what has been going on.
[ Parent
| on HN ]
Re:ESLint compromised, may have stolen your credentials
by maaaats on Thursday July 12, 2018 @09:27AM
(#17514222)
They say the package didn't come from their pipeline, so it's most likely published with stolen credentials. So it's not far-fetched to think those credentials were stolen the same way. More packages may be affected.
Re:ESLint compromised, may have stolen your credentials
by _bxg1 on Thursday July 12, 2018 @09:47AM
(#17514479)
They did say the pastebin has been taken down, so at least it won't spread further. Still, everybody who ever publishes anything should reset their credentials.
Re:ESLint compromised, may have stolen your credentials
by paulirwin on Thursday July 12, 2018 @10:47AM
(#17515130)
It won't spread further... for this specific package. There's nothing to prove that the virus isn't self-replicating and used a different pastebin/source or mechanism when affecting all packages of authors who've had their credentials compromised, and then authors that install the packages that depend on those packages, etc. When publishing credentials of other package authors have been compromised, the scope could be nearly the entire npm ecosystem.