NPM security update: Attack campaign using stolen OAuth tokens

Re:NPM security update: Attack campaign using stolen OAuth t... by arzel on Friday May 27, 2022 @03:53AM (#31527094)

What were* the passwords hashed with?

[ Parent | on HN ]

Re:NPM security update: Attack campaign using stolen OAuth t... by yardstick on Friday May 27, 2022 @04:03AM (#31527153)

From https://github.blog/2022-05-26-npm-security-update-oauth-tok...

“The password hashes in this archived data were generated using PBKDF2 or salted SHA1 algorithms previously used by the npm registry. These weak hashing algorithms have not been used to store npm user passwords since the npm registry began using bcrypt in 2017. ”

[ Parent | on HN ]