Postmortem for Malicious Packages Published on July 12th, 2018

Re:Postmortem for Malicious Packages Published on July 12th,... by davidbwire on Thursday July 12, 2018 @06:24PM (#17519123)

Moving forward NPM should require 2-factor authentication for popular packages.

[ Parent | on HN ]

Re:Postmortem for Malicious Packages Published on July 12th,... by algesten on Thursday July 12, 2018 @06:41PM (#17519228)

This seems like a good idea. If a package has more than x downloads or y dependencies, then require 2fa for publishing it.

[ Parent | on HN ]

Re:Postmortem for Malicious Packages Published on July 12th,... by nevir on Thursday July 12, 2018 @06:32PM (#17519170)

Or for publishing all packages

[ Parent | on HN ]

Re:Postmortem for Malicious Packages Published on July 12th,... by consumer451 on Friday July 13, 2018 @02:23PM (#17525409)

I cannot think of a reasonable argument against this if security is any priority at all at NPM.

[ Parent | on HN ]