DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by yawaramin on Tuesday September 09, 2025 @09:42PM (#45192039)

You can just create a new passkey on the new device after logging in. It's a non-issue.

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by 3eb7988a1663 on Tuesday September 09, 2025 @11:05PM (#45192706)

It is not a given that multiple services let you enroll multiple keys. How many year did it take before Amazon allowed multiple Yubikeys? Which means you are in a real pickle if you ever lose your one hardware device with keys (lost, stolen, bricked, whatever).

[ Parent | on HN ]

Re:DuckDB NPM packages 1.3.3 and 1.29.2 compromised with mal... by yawaramin on Wednesday September 10, 2025 @12:24PM (#45199995)

It's an incorrect implementation, the same as when eg an account provider truncates a long password to 8 characters.

[ Parent | on HN ]