NPM debug and chalk packages compromised

Re:NPM debug and chalk packages compromised by rollcat on Tuesday September 09, 2025 @06:46AM (#45180210)

> The solution is to tie a package to an identity using a certificate.

Identity on the Internet is a lie. Nobody knows you're a dog.

The solution is to make security easy and accessible, so that the user can't be confused into doing the insecure thing.

[ Parent | on HN ]

Re:NPM debug and chalk packages compromised by lelanthran on Tuesday September 09, 2025 @09:23AM (#45181591)

> Identity on the Internet is a lie.

What do you think HTTPS is?

[ Parent | on HN ]

Re:NPM debug and chalk packages compromised by mdaniel on Tuesday September 09, 2025 @11:15AM (#45183094)

Transport Layer Security, and has nothing to do with Identity. Take for example the perfectly valid certificate that was issued for npmjs[.]help which unquestionably does not belong to Microsoft/GitHub. Hell, even the certificate for npmjs.com is 'O=Google Trust Services' which doesn't sound like any of the business entities one would expect to own that cert

[ Parent | on HN ]

Re:NPM debug and chalk packages compromised by rollcat on Wednesday September 10, 2025 @08:29AM (#45196677)

"Whoever was on the cacert list that ships with your browser" has signed "I claim to be Acme Widgets Inc. and I own microsoft.com".

[ Parent | on HN ]