News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by mkfs on Tuesday September 09, 2025 @12:02PM (#45183937)
The 2FA/TOTP security theater was partly to blame for this.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by lurker_jMckQT99 on Tuesday September 09, 2025 @01:23PM (#45185262)
How so? Has the author mentioned somewhere that he was tricked into providing 2FA codes / had any sort of 2FA enabled at all?
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by mkfs on Wednesday September 10, 2025 @01:13AM (#45193584)
A spearphishing email telling them they had to update their 2FA was the vector.
[ Parent | on HN ]