News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by hackerindio on Monday September 08, 2025 @01:48PM (#45171420)
Hey, no problem, man. You do a lot for the community, and it's not all your fault. We learn from our mistakes. I was thinking of having a public fake profile to avoid this type of attack, but I'm not sure how it would work on the git tracking capabilities. Probably keeo it only internally for you&NPM ( the real one ) and have some fake ones open for public but not sure, just an obfuscated idea. Thanks for taking the responsibility and working in fixing ASAP. God bless you.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by Imustaskforhelp on Monday September 08, 2025 @05:05PM (#45173979)
Wow, that's actually kinda genius not gonna lie. Honestly, I would love seeing some 2fa or some other way to prevent pwning. Maybe having a sign up with google with all of its flaws still might make sense given how it might be 2fa.

But google comes with its own privacy nightmares.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by junon on Monday September 08, 2025 @05:26PM (#45174222)
Unfortunately wouldn't have helped. They skimmed my npm-only address directly from the public endpoint.
[ Parent | on HN ]