News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by Cthulhu_ on Monday September 08, 2025 @03:34PM (#45172846)
Tbh, it's not your fault per se; everybody can fall for phishing emails. The issue, IMO, lies with npmjs which publishes to everyone all at the same time. A delayed publish that allows parties like Aikido and co to scan for suspicious package uploads first (e.g. big changes in patch releases, obfuscated code, code that intercepts HTTP calls, etc), and a direct flagging system at NPM and / or Github would already be an improvement.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by junon on Monday September 08, 2025 @03:48PM (#45173027)
Being able to sign releases would help, too. I would happily have that enabled since I'm always publishing from one place.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by OptionOfT on Monday September 08, 2025 @04:57PM (#45173874)
Provenance can be added to NPM https://docs.npmjs.com/generating-provenance-statements

So if the hacker did an npm publish from local it would show up.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by Yoric on Monday September 08, 2025 @05:14PM (#45174089)
Wouldn't they have been able to change your key if they had compromised your entire npm account?

Also, junon.support++ – big thanks for being clear about all this.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by veber-alex on Monday September 08, 2025 @05:36PM (#45174338)
Hmm, maybe npm needs to do the same thing the iPhone does now.

If you change your key you can't use it for like 12 hours or something?

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by junon on Monday September 08, 2025 @05:27PM (#45174240)
Yes though in theory my public key would have been published elsewhere at least for verification. Valid point though, yes they would have been able to do that.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by dabockster on Monday September 08, 2025 @08:21PM (#45175874)
For this kind of infrastructure, some kind of real world verification may be necessary as well. Like having human ran phone verification (not AI, an actual call center) using information intentionally kept offline for securing more widespread and mission critical packages.

They can't pwn what they can't find online.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by jmb99 on Monday September 08, 2025 @11:22PM (#45177021)
Push to many repos with a brand new key would (should) trigger red flags.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by Yoric on Tuesday September 09, 2025 @01:41AM (#45177833)
Good point. But how should the red flag materialize?
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by josephg on Monday September 08, 2025 @11:23PM (#45177031)
Yeah; I wish provenance was more widely used. I think about this a lot for mobile apps. If you take an opensource iOS app like signal, you can read the source code on github. But there's actually no guarantee that the code on github corresponds in any way to the app I download from the app store.

With nodejs packages, I can open up node_modules and read the code. But packages get a chance to run arbitrary code on your computer after installation. By the time you can read the source code, it may be too late.

[ Parent | on HN ]