News for hackers. Stuff that matters.

A comment on NPM packages from Red Hat have been compromised. Parent comment

Re:NPM packages from Red Hat have been compromised by iconicBark on Monday June 01, 2026 @10:41AM (#48357467)
Is this more secure?? I would genuinely love to know
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by n_e on Monday June 01, 2026 @11:00AM (#48357714)
Yes (assuming they're doing frontend dev and including the resources from the page). The code is fetched and executed from the browser, so It'll have to escape the browser sandbox to do something nefarious.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by bdcravens on Monday June 01, 2026 @10:47AM (#48357545)
Yes, none of npm's lifecycle hooks. You're just pulling bytes over the wire.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by runtime_terror on Monday June 01, 2026 @11:01AM (#48357746)
Except now you're making http calls to remote servers that could be compromised.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by phpdave11 on Monday June 01, 2026 @11:30AM (#48358172)
As long as you embed it with an SRI integrity hash, you're safe, even if the remote server is compromised.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by bdcravens on Monday June 01, 2026 @01:33PM (#48360005)
Can be mitigated, as the sibling comment points out, but even in the situation you described, the blast radius is reduced, especially for frontend libs.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by grugdev42 on Monday June 01, 2026 @03:38PM (#48361591)
This is a solved problem.

Use HTTPS and use the integrity attribute.

https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...

Also, what's more likely? Someone hacking jsDelivr/cdnjs OR some random NPM packages getting hacked?

[ Parent | on HN ]