News for hackers. Stuff that matters.

A comment on Postmortem for Malicious Packages Published on July 12th, 2018. Parent comment

Re:Postmortem for Malicious Packages Published on July 12th,... by thenewwazoo on Thursday July 12, 2018 @08:34PM (#17519715)
FYI, I've downloaded all package versions uploaded between 2018-07-12T09:49:24.957Z and 2018-07-12T12:30:00Z (first compromised eslint package upload and key invalidation time), and got no hits for your signature strings in them.
[ Parent | on HN ]
Re:Postmortem for Malicious Packages Published on July 12th,... by rpearl on Thursday July 12, 2018 @08:35PM (#17519720)
key invalidation time was 2018-07-12 18:42 UTC

How did you produce this list btw?

[ Parent | on HN ]
Re:Postmortem for Malicious Packages Published on July 12th,... by thenewwazoo on Thursday July 12, 2018 @08:41PM (#17519749)
I'm still not totally clear on that, btw - they claim they invalidated keys created before 2018-07-12T12:30:00Z, but they did it at 2018-07-12 18:42 UTC. I can't decide if that's problematic.

I downloaded the contents of the npm couchdb and did an exhaustive search of version timestamps.

[ Parent | on HN ]
Re:Postmortem for Malicious Packages Published on July 12th,... by rpearl on Thursday July 12, 2018 @11:42PM (#17520378)
they invalidated keys based on when the attack became non-functional (due to the pastebin getting removed at 12:27 UTC). But the window in which any packages could potentially have been similarly compromised is from the point the attacker had access to tokens through the point they were invalidated.
[ Parent | on HN ]