Re:NPM debug and chalk packages compromised
by xrd on Monday September 08, 2025 @02:56PM
(#45172307)
It wouldn't be a perfect solution, but I wonder why browsers don't indicate the registration date for a domain in the URL bar somehow? I bet junon would have seen that and gotten suspicious.
[ Parent
| on HN ]
Re:NPM debug and chalk packages compromised
by gaudystead on Monday September 08, 2025 @05:19PM
(#45174142)
I like this idea and could see it being visually represented as a faint red/green bar behind the URL text in the address bar, with a greater amount of the bar being red when the domain is less trusted.
As for developers trusting a plugin that reaches out to an external location to determine the reputation of every website they visit seems like a harder sell though.
Re:NPM debug and chalk packages compromised
by webdev1234568 on Monday September 08, 2025 @05:27PM
(#45174236)
that's a good one not perfect for sure, hackers would just start buying domains earlier but still...
Re:NPM debug and chalk packages compromised
by xrd on Monday September 08, 2025 @07:45PM
(#45175613)
Yeah, but there is a takedown process when a spam site is detected (the server provider can shut off access, etc), so it is a game that is somewhat winnable.
Re:NPM debug and chalk packages compromised
by AtNightWeCode on Tuesday September 09, 2025 @02:43AM
(#45178330)
There are curated lists over newly registered domain names that some security software uses so it should be easy to add without any privacy issues.