Re:NPM debug and chalk packages compromised
by cluckindan on Monday September 08, 2025 @05:11PM
(#45174057)
And one pwned domain later, we are back in square one.
[ Parent
| on HN ]
Re:NPM debug and chalk packages compromised
by lelanthran on Tuesday September 09, 2025 @12:47AM
(#45177524)
> And one pwned domain later, we are back in square one.
1. It's an extra step: before you pwn the package, you need to pwn a domain.
2. When a domain is pwned, the packages it signs can be revoked with a single command.