News for hackers. Stuff that matters.

A comment on ESLint compromised, may have stolen your credentials. Parent comment

Re:ESLint compromised, may have stolen your credentials by Gaelan on Thursday July 12, 2018 @12:25PM (#17516117)
Not that it’s a bad idea in general, but I don’t think it would help in this situation. I’ve never published NPM packages, but I’m assuming that it only asks for a 2FA token when you first log in, and not every time you publish. Because this thing is stealing local tokens, I think 2FA wouldn’t help.
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by snowwolf on Thursday July 12, 2018 @12:39PM (#17516295)
Possibly not, but it would have prevented the compromise in the first place. My advice was less about helping people affected by this and more about trying to prevent the next one.
[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by paulirwin on Thursday July 12, 2018 @01:38PM (#17516867)
Your assumption appears to be incorrect. If you set up 2FA in "auth-and-writes" mode, it does require a 2FA challenge to publish.

Docs: https://docs.npmjs.com/getting-started/using-two-factor-auth...

[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by ceejayoz on Thursday July 12, 2018 @12:42PM (#17516328)
Maybe NPM should ask for a 2FA to publish every time?
[ Parent | on HN ]