News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by anthk on Monday September 08, 2025 @05:24PM (#45174196)
APT repos for Debian, Trisquel, Ubuntu... require far more checkings and bureaucracy.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by socalgal2 on Monday September 08, 2025 @05:40PM (#45174375)
I'll bet they don't. There's way to much churn for it all to be checked
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by const_cast on Monday September 08, 2025 @07:36PM (#45175530)
Churn? On Debian?

It takes like 2 years to get up to date packages. This isn't NPM.

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by SchemaLoad on Monday September 08, 2025 @11:06PM (#45176926)
The xscreensaver dev managed to very easily slip a timebomb in to the debian repos. Wasn't obscured in any way, the repo maintainers just don't review the code. It would be physically impossible for them to review all the changes in all the programs.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by justusthane on Monday September 08, 2025 @06:35PM (#45174994)
No, they are extremely well vetted. Have you ever heard of a supply chain attack involving Red Hat, Debian or Ubuntu repos?
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by jonquest on Monday September 08, 2025 @06:56PM (#45175191)
Yes, the XZ attack affected Fedora nightly and Debian testing and unstable. Yes, it got caught before it made it into a stable distribution (this time).

https://www.redhat.com/en/blog/understanding-red-hats-respon...

https://lists.debian.org/debian-security-announce/2024/msg00...

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by goodpoint on Tuesday September 09, 2025 @08:37AM (#45181120)
So the attack was successfully stopped and you complain about it?
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by jonquest on Tuesday September 09, 2025 @02:34PM (#45186470)
I’m not complaining, I’m pointing out facts. If the facts offend you, that’s your problem. Ignore them if you wish.
[ Parent | on HN ]