News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by jffry on Tuesday September 09, 2025 @01:17AM (#45177692)
> Anyway didn't this replace versions, so locking won't have helped either?

The lockfile includes a hash of the tarball, doesn't it?

[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by Already__Taken on Tuesday September 09, 2025 @04:06PM (#45188049)
It does, the answer to my question was no.
[ Parent | on HN ]