NPM packages from Red Hat have been compromised

Re:NPM packages from Red Hat have been compromised by bandrami on Monday June 01, 2026 @10:33AM (#48357383)

That's why we don't let the developers run system package manager install scripts as root. We do let them run npm inside containers, which is still more access than I'd like them to have.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by icedchai on Monday June 01, 2026 @12:02PM (#48358673)

Is this one of those places where it takes 6 to 12 weeks to get something new installed on your machine?

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by bandrami on Monday June 01, 2026 @12:06PM (#48358716)

You mean directly on the machine? Not in a container? That would be a recklessly fast timeline. The configuration control board meets quarterly and it usually takes 4 or 5 meetings to clear a piece of software.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by icedchai on Monday June 01, 2026 @12:09PM (#48358759)

Interesting. How about in a container? What industry is this, just curious?

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by bandrami on Monday June 01, 2026 @12:28PM (#48359065)

Defense. Containers on our normal network are the wild west, but anything that touches the secure network has to be signed off on by the clients.

[ Parent | on HN ]