News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by lucideer on Tuesday September 16, 2025 @11:36AM (#45263716)
A lot of people use tools like Dependabot which automates updates to the lockfile.
[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by Tadpole9181 on Wednesday September 17, 2025 @10:53PM (#45284666)
That's unrelated to this.

As well, both Dependabot and Renovate in isolated environments withour secrets or privileges, need to be manually approved, and have minimum publication ages before recommending a package update to prevent basic supply chain attacks or lockfile corruption from a pinned package version being de-published (up to a 3 day window on NPM).

[ Parent | on HN ]