News for hackers. Stuff that matters.

A comment on Ledger's NPM account has been hacked. Parent comment

Re:Ledger's NPM account has been hacked by meagher on Thursday December 14, 2023 @03:09PM (#38646593)
Love Socket! A lot of folks (think most) were loading the compromised package through another package, @ledgerhq/connect-kit-loader [1], via a CDN call [2]. Would be great if Socket could pick up on this because Socket's @ledgerhq/connect-kit-loader page [3] doesn't include any warning.

[1]: https://socket.dev/npm/package/@ledgerhq/connect-kit-loader

[2]: https://github.com/LedgerHQ/connect-kit/blob/main/packages/c...

[3]: https://socket.dev/npm/package/@ledgerhq/connect-kit-loader/...

[ Parent | on HN ]
Re:Ledger's NPM account has been hacked by feross on Thursday December 14, 2023 @05:41PM (#38648386)
Thanks for reporting this. Fixed: https://socket.dev/npm/package/@ledgerhq/connect-kit-loader/...

We don't currently detect 'implicit dependencies' loaded via CDN URLs, though we'll look into what it would take to support this.

[ Parent | on HN ]
Re:Ledger's NPM account has been hacked by meagher on Thursday December 14, 2023 @06:46PM (#38649085)
Sounds good. Excited for this and all future Socket improvements!
[ Parent | on HN ]