News for hackers. Stuff that matters.

A comment on Self Propagating NPM Malware Compromises over 40 Packages. Parent comment

Re:Self Propagating NPM Malware Compromises over 40 Packages by singulasar on Wednesday September 17, 2025 @06:29AM (#45274026)
on the other hand, the previous supply chain attack was found by automated tech. Also, if MS would be so kind as to just run similar scans at the time a package is updated instead of after the package is updated (which is the only way the automated tech can run if npm doesn't integrate it), then malware like this would be way less common.

MS doesn't care

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by kjok on Thursday September 18, 2025 @11:55AM (#45291220)
> on the other hand, the previous supply chain attack was found by automated tech.

Are you sure about this? Would love to see which ones.

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by singulasar on Thursday September 18, 2025 @12:59PM (#45292071)
The chalk/debug one https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com... I believe socket also found it this way just a bit later.

The dev later said that Charlie notifying him probably shaved off some very important time for the remediation.

So in this case 2 different companies found it using automated tech before anyone else

[ Parent | on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages by CharlieEriksen on Friday September 19, 2025 @03:16AM (#45298801)
Hi, I'm Charlie from Aikido, as mentioned above. Yes, we detected it automatically, and I alerted Josh to the situation on BSky.

There's no reason why Microsoft/npm can't do what we're doing, or any of the other handful to dozen companies that do similar things to us, to protect the supply chain.

[ Parent | on HN ]