NPM debug and chalk packages compromised

Re:NPM debug and chalk packages compromised by paulddraper on Monday September 08, 2025 @12:04PM (#45169982)

Maintainer phished.

Was caught quickly (hours? hard to be sure, the versions have been removed/overwritten).

Attacker owns npmjs.help domain.

[ Parent | on HN ]

Re:NPM debug and chalk packages compromised by DDerTyp on Monday September 08, 2025 @12:18PM (#45170159)

Noticed that after ten mins, contacted author immediatly and he seems to be working on it / restoring his account / removing malware on published packages.

Kinda "proud" on it haha :D

[ Parent | on HN ]

Re:NPM debug and chalk packages compromised by jbverschoor on Monday September 08, 2025 @12:36PM (#45170407)

Doesn’t npmjs do things like signing, pinning, and yanking packages, like rubygems?

[ Parent | on HN ]

Re:NPM debug and chalk packages compromised by paulddraper on Monday September 08, 2025 @02:48PM (#45172206)

Yes

[ Parent | on HN ]