News for hackers. Stuff that matters.

A comment on ESLint compromised, may have stolen your credentials. Parent comment

Re:ESLint compromised, may have stolen your credentials by thephyber on Thursday July 12, 2018 @05:31PM (#17518794)
One of the notes on the ESLint postmortem[1] was that developers shouldn't reuse passwords and should use a password manager to facilitate making this easier.

While I ack that 2FA would have prevented this incident, so would have using unique credentials. Note that using unique credentials is available at every SaaS service, not just the ones that support 2FA.

[1] https://eslint.org/blog/2018/07/postmortem-for-malicious-pac...

[ Parent | on HN ]
Re:ESLint compromised, may have stolen your credentials by micimize on Thursday July 12, 2018 @05:45PM (#17518893)
right, but 2FA usage is something npm can actually verify, so that we as package consumers can ask/receive some security guarantees from publishers.
[ Parent | on HN ]