News for hackers. Stuff that matters.

A comment on NPM packages from Red Hat have been compromised. Parent comment

Re:NPM packages from Red Hat have been compromised by bdcravens on Monday June 01, 2026 @10:47AM (#48357545)
Yes, none of npm's lifecycle hooks. You're just pulling bytes over the wire.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by runtime_terror on Monday June 01, 2026 @11:01AM (#48357746)
Except now you're making http calls to remote servers that could be compromised.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by phpdave11 on Monday June 01, 2026 @11:30AM (#48358172)
As long as you embed it with an SRI integrity hash, you're safe, even if the remote server is compromised.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by bdcravens on Monday June 01, 2026 @01:33PM (#48360005)
Can be mitigated, as the sibling comment points out, but even in the situation you described, the blast radius is reduced, especially for frontend libs.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by grugdev42 on Monday June 01, 2026 @03:38PM (#48361591)
This is a solved problem.

Use HTTPS and use the integrity attribute.

https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...

Also, what's more likely? Someone hacking jsDelivr/cdnjs OR some random NPM packages getting hacked?

[ Parent | on HN ]