News for hackers. Stuff that matters.

A comment on Postmortem: TanStack npm supply-chain compromise. Parent comment

Re:Postmortem: TanStack npm supply-chain compromise by Gigachad on Monday May 11, 2026 @08:44PM (#48102754)
On linux realistically whatever user you installed the malicious NPM package with has access to everything you care about anyway.
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by lrvick on Monday May 11, 2026 @09:40PM (#48103163)
Every user, since privesc is so easy on most operating systems.
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by Gigachad on Monday May 11, 2026 @09:42PM (#48103176)
Sure, without exploits they can steal your api keys, read your personal data, and access your browser data. With exploits they can update packages on your computer too.
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by lrvick on Monday May 11, 2026 @10:45PM (#48103606)
No exploits needed. A simple shell alias will suffice. See my example in sibling comment.
[ Parent | on HN ]
Re:Postmortem: TanStack npm supply-chain compromise by silon42 on Tuesday May 12, 2026 @05:53AM (#48106137)
I had an idea to always run 2 users, the "main" one (or more) and a "project one"... one could sudo to the project user, but that one could not sudo out... (npm would only be installed for the project user).
[ Parent | on HN ]