NPM debug and chalk packages compromised

Re:NPM debug and chalk packages compromised by junon on Monday September 08, 2025 @12:41PM (#45170483)

They phished username, password (unique to npm), and a TOTP code.

They even gave me a new TOTP code to install (lol) and it worked. Showed up in authy fine. Whoever made this put a ton of effort into it.

[ Parent | on HN ]

Re:NPM debug and chalk packages compromised by scratchyone on Monday September 08, 2025 @02:23PM (#45171903)

Damn, that's an impressively well-done attack. Curious, do you use a password manager? If so, did it not autofilling feel like a red flag to you?

I've always wondered if I ever get phished if I'll notice bc of that or if I'll just go "ugh 1password isn't working, guess i'll paste my password in manually" and end up pwned

[ Parent | on HN ]

Re:NPM debug and chalk packages compromised by nixosbestos on Monday September 08, 2025 @04:16PM (#45173371)

I'm thinking on what all the anti-passkey folks have to say right now. Or the "password managers aren't necessary" crowd.

[ Parent | on HN ]

Re:NPM debug and chalk packages compromised by junon on Monday September 08, 2025 @03:00PM (#45172375)

I was on mobile, didn't use the autofiller. Also previous experience with the web extensions showed me that they were flakey at best anyway.

The `.help` should have been the biggest red flag, followed by the 48-hours request timeline. I wasn't thinking about things like I normally would this morning and just wanted to get things done today. Been a particularly stressful week, not that it's any excuse.

[ Parent | on HN ]