News for hackers. Stuff that matters.

A comment on Postmortem for Malicious Packages Published on July 12th, 2018.

Re:Postmortem for Malicious Packages Published on July 12th,... by benwilber0 on Thursday July 12, 2018 @07:56PM (#17519579)
I am very surprised they stopped at just grabbing your .npmrc. They could have grabbed basically anything they want like ~/.aws/credentials, your whole .bashrc (which often contains a whole slew of API keys and access tokens), and even your whole ~/.ssh
[ Parent | on HN ]
Re:Postmortem for Malicious Packages Published on July 12th,... by joeandaverde on Thursday July 12, 2018 @09:54PM (#17519992)
Clearly more could have been done. It's suspicious that they'd only grab npm tokens. Perhaps the responsible party just wanted to prove a point?
[ Parent | on HN ]
Re:Postmortem for Malicious Packages Published on July 12th,... by sonnhy on Friday July 13, 2018 @04:17AM (#17521307)
It looks like a virus that may try to replicate later on. If it passed unnoticed it could have gathered so much npm tokens to actually attack a much larger portion of developers. But nonetheless, starting with eslint should already provide quite a lot of credentials.
[ Parent | on HN ]
Re:Postmortem for Malicious Packages Published on July 12th,... by pvtmert on Friday July 13, 2018 @09:31AM (#17522775)
just get known_hosts and id_rsa rule the ~world~ cloud
[ Parent | on HN ]