News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by rootlocus on Monday September 08, 2025 @03:20PM (#45172660)
> Made the mistake of clicking the link instead of going directly to the site like I normally would (since I was mobile).

Does anyone know how this attack works? Is it a CSRF against npmjs.com?

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by junon on Monday September 08, 2025 @03:25PM (#45172742)
That was the low-tech part of their attack, and was my fault - both for clicking on it and for my phrasing.

It wasn't a single-click attack, sorry for the confusion. I logged into their fake site with a TOTP code.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by yard2010 on Monday September 08, 2025 @04:31PM (#45173563)
This is a clear example that this can happen to anyone.

Sorry for what you're going through.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by SchemaLoad on Monday September 08, 2025 @11:10PM (#45176951)
This is why Passkeys are getting pushed right now. They make it physically impossible to sign in to a phishing site.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by smeijer87 on Monday September 08, 2025 @03:25PM (#45172736)
Probably just a fake site.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by veber-alex on Monday September 08, 2025 @05:40PM (#45174383)
Fake site.

You login with your credentials, the attacker logins to the real site.

You get an SMS with a one time code from the real site and input it to the fake site.

The attacker takes the code andc finishes the login to the real site.

[ Parent | on HN ]