ESLint compromised, may have stolen your credentials

Re:ESLint compromised, may have stolen your credentials by kevin_b_er on Thursday July 12, 2018 @12:18PM (#17516043)

This is not possible under the npm/js paradigm of massive module dependency trees. You'll get a module and it will have 10 dependencies and each of those 10 dependencies will each have 5 dependencies. Three of those at the 4th level was an infected eslint package.

They've learned precious little since left-pad.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by cphoover on Thursday July 12, 2018 @01:01PM (#17516520)

Right! that's what I thought this is left-pad all over again.

Although left-pad was really just a disgruntled publisher... this involves a malicious third party.

My suggestion in fixing the later would be to enforce 2FA for publishing of packages that have so many dependents.

Award a badge to a release when it is published with 2FA. So for LTS releases they can be verified as manually published. This will impact package consumers decision making process, on whether or not to include a dependency into their package.json.

[ Parent | on HN ]