DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by jsheard on Tuesday September 09, 2025 @07:33AM (#45180542)

It is, if your packages are popular enough then npm will force you to enable 2FA. That doesn't stop everything though, the big attack yesterday went through 2FA by tricking the author into doing a "2FA reset".

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by frizlab on Tuesday September 09, 2025 @07:43AM (#45180601)

Passkeys should be enforced

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by frizlab on Tuesday September 09, 2025 @09:56AM (#45181981)

I take the downvote but I’d like to know why?

Passkeys are effectively and objectively a better security solution than password+2FA. Among other things, they are completely unfishable.

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by cesarb on Tuesday September 09, 2025 @11:59AM (#45183899)

> Among other things, they are completely unfishable.

From what I've heard, they're also unbackupable, and tied to the ecosystem used to create them (so if you started with an Apple desktop, you can't later migrate the passkeys to a Windows desktop, you have to go to every single site you've ever used and create new ones).

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by smw on Tuesday September 09, 2025 @12:12PM (#45184125)

You can't really backup hardware tokens, either? It's quite possible to use something like bitwarden/vaultwarden/1password as a password manager, and you can "backup" tokens quite easily without being tied to a particular mobile/desktop ecosystem.

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by frizlab on Tuesday September 09, 2025 @05:03PM (#45189087)

That’s not true anymore; you can migrate passkeys to another password manager now.

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by yawaramin on Tuesday September 09, 2025 @09:42PM (#45192039)

You can just create a new passkey on the new device after logging in. It's a non-issue.

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by 3eb7988a1663 on Tuesday September 09, 2025 @11:05PM (#45192706)

It is not a given that multiple services let you enroll multiple keys. How many year did it take before Amazon allowed multiple Yubikeys? Which means you are in a real pickle if you ever lose your one hardware device with keys (lost, stolen, bricked, whatever).

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by yawaramin on Wednesday September 10, 2025 @12:24PM (#45199995)

It's an incorrect implementation, the same as when eg an account provider truncates a long password to 8 characters.

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by smw on Tuesday September 09, 2025 @12:10PM (#45184093)

Parent is exactly right! For critical infrastructure an un-phishable 2fa mechanism like passkeys or hardware token (FIDO2/yubikey) should be required! It would remove this category of attack completely.

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by diggan on Tuesday September 09, 2025 @08:34AM (#45181093)

> It is, if your packages are popular enough then npm will force you to enable 2FA.

Are they actively forcing it? I've received the "Remember to enable 2FA" email notifications from NPM since 2022 I think, but haven't bothered since I'm not longer publishing packages/updates.

Besides, the email conveniently mentions their "automation" tokens as well, which when used for publishing updates, bypasses 2FA fully.

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by jsheard on Tuesday September 09, 2025 @08:38AM (#45181136)

Did you ever get this email?

https://old.reddit.com/r/node/comments/xftu7i/comment/iooabn...

[ Parent | on HN ]