NPM packages from Red Hat have been compromised

Re:NPM packages from Red Hat have been compromised by dns_snek on Monday June 01, 2026 @02:44PM (#48360935)

It doesn't matter how much of the package you use. Here, you can use literally 0% of Koa and get pwned by one of its transitive dependencies (koa > cookies > keygrip > tsscmp) by simply importing the parent package:

    mkdir demo && cd demo
    npm install --save [email protected]
    echo 'console.log("--- pwned by a transitive dependency ---")' >> node_modules/tsscmp/lib/index.js
    node -e "import 'koa'"

--- pwned by a transitive dependency ---

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by oblio on Tuesday June 02, 2026 @04:19AM (#48367427)

My point was for proper package management tools that don't allow running scripts.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by IshKebab on Tuesday June 02, 2026 @05:40AM (#48367956)

His example did not involve running any post-install scripts.

[ Parent | on HN ]