News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by bflesch on Monday September 08, 2025 @12:38PM (#45170458)
Can you attribute this technique to a specific group?
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by pants2 on Monday September 08, 2025 @03:27PM (#45172761)
Almost certainly Lazarus
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by sflanagain on Monday September 08, 2025 @04:05PM (#45173246)
The phishing email comes across a bit too amateur. Specifically the inclusion of:

"we kindly ask that you complete this update your earliest convenience".

The email was included here: https://cdn.prod.website-files.com/642adcaf364024654c71df23/...

From this article: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com...

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by rurban on Tuesday September 09, 2025 @09:45PM (#45192061)
Very amateur. Who would fall that, really? I can only suspect npm people who are used to unprofessional repo hosting practices.

Such a Two Factor Authentication update request would have needed a blog post first, to announce such a fishy request.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by suzzer99 on Monday September 08, 2025 @01:04PM (#45170794)
A few years ago, I remember reading about some NFT contract attack that did something similar. So I'm sure it's out there now.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by illegally on Tuesday September 09, 2025 @01:54PM (#45185696)
It's not a "group specific" technique.

This is smart, but not really unusual.

[ Parent | on HN ]