News for hackers. Stuff that matters.

A comment on Active NPM supply chain attack: Tinycolor and 40 Packages Compromised. Parent comment

Re:Active NPM supply chain attack: Tinycolor and 40 Packages... by wrs on Tuesday September 16, 2025 @12:51AM (#45258141)
The pnpm version of this is persistent. You approve the package once, and regular install works thereafter. Which is nice.
[ Parent | on HN ]
Re:Active NPM supply chain attack: Tinycolor and 40 Packages... by DemocracyFTW2 on Tuesday September 16, 2025 @03:49AM (#45259288)
is that permission tied to a specific version with a specific fingerprint/hash? because if it's not then you could still get a surprise come the next update...
[ Parent | on HN ]
Re:Active NPM supply chain attack: Tinycolor and 40 Packages... by wrs on Tuesday September 16, 2025 @04:04PM (#45267258)
It is by package name, but at least you won't be surprised when left-pad suddenly has an install script.

You can put a fingerprint on the package dependency itself, though, so if you add a fingerprint to anything you approve the install script for, you will get that level of safety.

[ Parent | on HN ]