News for hackers. Stuff that matters.

A comment on NPM packages from Red Hat have been compromised. Parent comment

Re:NPM packages from Red Hat have been compromised by saturn_vk on Monday June 01, 2026 @10:59AM (#48357706)
The package might not ever be executed on the user's machine. Depending on your setup, it might only be ran on a server, where the data that can be exfiltrated is completely different.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by PunchyHamster on Monday June 01, 2026 @11:23AM (#48358078)
Why you are downloading code if you're not even using it to run tests ?

And if you run tests in CI/CD, or in a container, why you are downloading code locally ? Only thing that comes to mind is code completion but surely most people at least run unit tests locally before pushing the code out ?

[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by Petersipoi on Monday June 01, 2026 @11:09AM (#48357878)
Sure but like.. come on. Is that really a defense? Most packages are run on devs machines. And it's not like "Oh it's just running on my production server, what could go wrong there" is any better.
[ Parent | on HN ]
Re:NPM packages from Red Hat have been compromised by ZiiS on Monday June 01, 2026 @11:39AM (#48358337)
We should not dismiss that it is slightly better. Production servers vary rarely have creds to the source repository nor to other production servers running possibly more sensitive code where investing in a smaller supply chain was justified.
[ Parent | on HN ]