News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by Yoric on Monday September 08, 2025 @05:14PM (#45174089)
Wouldn't they have been able to change your key if they had compromised your entire npm account?

Also, junon.support++ – big thanks for being clear about all this.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by veber-alex on Monday September 08, 2025 @05:36PM (#45174338)
Hmm, maybe npm needs to do the same thing the iPhone does now.

If you change your key you can't use it for like 12 hours or something?

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by junon on Monday September 08, 2025 @05:27PM (#45174240)
Yes though in theory my public key would have been published elsewhere at least for verification. Valid point though, yes they would have been able to do that.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by dabockster on Monday September 08, 2025 @08:21PM (#45175874)
For this kind of infrastructure, some kind of real world verification may be necessary as well. Like having human ran phone verification (not AI, an actual call center) using information intentionally kept offline for securing more widespread and mission critical packages.

They can't pwn what they can't find online.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by jmb99 on Monday September 08, 2025 @11:22PM (#45177021)
Push to many repos with a brand new key would (should) trigger red flags.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by Yoric on Tuesday September 09, 2025 @01:41AM (#45177833)
Good point. But how should the red flag materialize?
[ Parent | on HN ]