News for hackers. Stuff that matters.

A comment on ESLint compromised, may have stolen your credentials. Parent comment

Re:ESLint compromised, may have stolen your credentials by _bxg1 on Thursday July 12, 2018 @09:43AM (#17514434)
Unfortunately in this case, since the source repository itself wasn't compromised, there was nothing to audit (assuming the final bundle was packed/minified).

One interesting mitigation would be for NPM to allow you to bind your package directly to a particular repo. So rather than a user (or job system) having to manually go in and publish releases, NPM could assure that what's live always matches what's in the repo.

I've always wondered, how does apt-get solve this? Do they audit every package?

[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by namibj on Thursday July 12, 2018 @10:26AM (#17514910)
They build them themselves, and vet holders of signing keys. They have _much_ better opsec than the NPM ecosystem.
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by rattray on Thursday July 12, 2018 @10:02AM (#17514656)
Yeah, `npm publish` should just – on npm's servers – fetch a github repo and run a build command. This would be more secure, convenient, and less prone to silly errors (like forgetting to build before releasing).
[ Parent | on HN ]