News for hackers. Stuff that matters.

A comment on NPM debug and chalk packages compromised. Parent comment

Re:NPM debug and chalk packages compromised by greatestdevever on Wednesday September 10, 2025 @04:38AM (#45194912)
Hey, new dev here. Sorry if this is a common knowledge and I am asking a stupid question. How does you getting phished affect these NPM packages? aren't these handled by NPM or the developers of them?
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by p91paul on Wednesday September 10, 2025 @08:21AM (#45196606)
The guy is actually the maintainer of those packages. So whoever got his credentials became able to perform releases on those packages. NPM itself does not build any package, it's just a place where people can publish stuff
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by handstitched on Wednesday September 10, 2025 @08:22AM (#45196610)
OP is the developer & maintainer of the affected packages, so the attacker was able to use their phished credentials to upload compromised versions to NPM.
[ Parent | on HN ]
Re:NPM debug and chalk packages compromised by greatestdevever on Thursday September 18, 2025 @03:17AM (#45286555)
oh! understood. thanks.
[ Parent | on HN ]