News for hackers. Stuff that matters.

A comment on DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware. Parent comment

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by diggan on Tuesday September 09, 2025 @08:34AM (#45181093)
> It is, if your packages are popular enough then npm will force you to enable 2FA.

Are they actively forcing it? I've received the "Remember to enable 2FA" email notifications from NPM since 2022 I think, but haven't bothered since I'm not longer publishing packages/updates.

Besides, the email conveniently mentions their "automation" tokens as well, which when used for publishing updates, bypasses 2FA fully.

[ Parent | on HN ]
Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by jsheard on Tuesday September 09, 2025 @08:38AM (#45181136)
Did you ever get this email?

https://old.reddit.com/r/node/comments/xftu7i/comment/iooabn...

[ Parent | on HN ]