NPM packages from Red Hat have been compromised

Re:NPM packages from Red Hat have been compromised by winrid on Monday June 01, 2026 @11:53AM (#48358542)

not if you have internal repos?

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by hedora on Monday June 01, 2026 @12:37PM (#48359169)

I think you can set it on internal repos, but then you need to allow-list internal code. People act like this is simple + solved, but it's not. It turns into 100K-1M's of LLM tokens on a semi-regular basis, or "just hire a build infra team for your side project" pretty quickly.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by winrid on Wednesday June 03, 2026 @03:09AM (#48380888)

did you write this with an LLM? also, no, there are no docs for allow listing internal libraries or namespaces in NPM that I can find

[ Parent | on HN ]