NPM debug and chalk packages compromised

Re:NPM debug and chalk packages compromised by lelanthran on Tuesday September 09, 2025 @09:23AM (#45181591)

> Identity on the Internet is a lie.

What do you think HTTPS is?

[ Parent | on HN ]

Re:NPM debug and chalk packages compromised by mdaniel on Tuesday September 09, 2025 @11:15AM (#45183094)

Transport Layer Security, and has nothing to do with Identity. Take for example the perfectly valid certificate that was issued for npmjs[.]help which unquestionably does not belong to Microsoft/GitHub. Hell, even the certificate for npmjs.com is 'O=Google Trust Services' which doesn't sound like any of the business entities one would expect to own that cert

[ Parent | on HN ]

Re:NPM debug and chalk packages compromised by rollcat on Wednesday September 10, 2025 @08:29AM (#45196677)

"Whoever was on the cacert list that ships with your browser" has signed "I claim to be Acme Widgets Inc. and I own microsoft.com".

[ Parent | on HN ]