News for hackers. Stuff that matters.
Re:NPM debug and chalk packages compromised by xrd on Monday September 08, 2025 @02:56PM (#45172307)
It wouldn't be a perfect solution, but I wonder why browsers don't indicate the registration date for a domain in the URL bar somehow? I bet junon would have seen that and gotten suspicious.
Re:NPM debug and chalk packages compromised by gaudystead on Monday September 08, 2025 @05:19PM (#45174142)
I like this idea and could see it being visually represented as a faint red/green bar behind the URL text in the address bar, with a greater amount of the bar being red when the domain is less trusted.

As for developers trusting a plugin that reaches out to an external location to determine the reputation of every website they visit seems like a harder sell though.

Re:NPM debug and chalk packages compromised by webdev1234568 on Monday September 08, 2025 @05:27PM (#45174236)
that's a good one not perfect for sure, hackers would just start buying domains earlier but still...
Re:NPM debug and chalk packages compromised by xrd on Monday September 08, 2025 @07:45PM (#45175613)
Yeah, but there is a takedown process when a spam site is detected (the server provider can shut off access, etc), so it is a game that is somewhat winnable.
Re:NPM debug and chalk packages compromised by AtNightWeCode on Tuesday September 09, 2025 @02:43AM (#45178330)
There are curated lists over newly registered domain names that some security software uses so it should be easy to add without any privacy issues.