NPM packages from Red Hat have been compromised

Re:NPM packages from Red Hat have been compromised by user3939382 on Monday June 01, 2026 @10:41PM (#48365325)

Then shouldn’t the analyzers just be part of NPMs acceptance requirements?

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by zwily on Tuesday June 02, 2026 @01:27AM (#48366412)

That’s my point. For whatever reason, npm isn’t doing it. All npm users adding a minimum package age is kind of like doing it as a collective, without npm’s help.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by _flux on Tuesday June 02, 2026 @07:35AM (#48368868)

I think if they did it, then attackers would be able to iterate their attack against their own project, and once it passes the filters they could deploy for real.

I guess it could work better if it was enabled for only actual attack vectors projects.

[ Parent | on HN ]