News for hackers. Stuff that matters.

A comment on Compromising Angular via expired NPM publisher email domains. Parent comment

Re:Compromising Angular via expired NPM publisher email domains by robbie-c on Sunday February 20, 2022 @11:28AM (#30406881)
> I don't like GitHub's security screener dismissing this report because of the "social engineering" aspect.

Agreed.

I get where it comes from, npm isn't responsible for individual contributors getting social-engineered, but this is much deeper than that, and part of the flaw is with npm's support allowing the password reset to go through.

[ Parent | on HN ]
Re:Compromising Angular via expired NPM publisher email domains by codingkev on Sunday February 20, 2022 @05:13PM (#30409753)
What do you suggest as an alternative to password reset based on the account email?
[ Parent | on HN ]
Re:Compromising Angular via expired NPM publisher email domains by tedunangst on Sunday February 20, 2022 @05:17PM (#30409782)
If you retired the email because the domain expired, maybe don't let it reset existing accounts. It's dead.
[ Parent | on HN ]