ESLint compromised, may have stolen your credentials

Re:ESLint compromised, may have stolen your credentials by cphoover on Thursday July 12, 2018 @01:24PM (#17516744)

an ssh key is just a file on your computer the same way they stole the ~/.npmrc file. They could just as easily steal your ~/.ssh/id_rsa private key.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by no_wizard on Thursday July 12, 2018 @11:41PM (#17520367)

Sure this is true. Though the audience of folks that would 1.know what an ssh key is and 2. Know how to generate one I would put better than average odds in on the ssh key not being compromised than any internet account particularly if it does not have 2fa enabled

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by Celarnor on Thursday July 12, 2018 @02:06PM (#17517120)

This is why your SSH key has no business being in the filesystem and should instead be on a hardware token where all the crypto/signing operations happen on the HW token's chip.

[ Parent | on HN ]

Re:ESLint compromised, may have stolen your credentials by cesarb on Thursday July 12, 2018 @02:00PM (#17517069)

That file is often encrypted with a password, so it's not that trivial.

[ Parent | on HN ]