ESLint compromised, may have stolen your credentials

Re:ESLint compromised, may have stolen your credentials by yosito on Thursday July 12, 2018 @11:50AM (#17515753)

Here are some useful commands you can use to secure your environment in light of this hack: https://gist.github.com/localjo/59bb12b7a4789e01e3782cf8a103...

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by thephyber on Thursday July 12, 2018 @05:35PM (#17518815)

Note that NPM claims they already disabled NPM access tokens that were used during the timeframe they assigned to this incident so if you were affected, your token was already revoked.

Also, ESLint's postmortem[1] suggests this was password reuse (matching a creds from a previously popped service) + lack of 2FA. In short, a failure of a developer with publish permissions to use basic security hygiene.

[1] https://eslint.org/blog/2018/07/postmortem-for-malicious-pac...

[ Parent | on HN ]