3 ms·

Yes I'd be very curious to see a debrief on what the technical cause was. Thanks to the npm team for a quick weekend fix, at any rate!

• seldo 9y ago
  We're working on a full post-mortem now. Until then we don't want to give out misleading/partial information.
  • fl00d 9y ago
    Any update on the post-mortem? How long have the binaries been replaced? Is there evidence that malware was injected into the binaries? Additionally, you should brush up on your code signing implementations. Had you signed it with a trusted code signing cert, consumers could have verified that you produced the binaries...and not a malicious user. Assuming they didnt have access to the private key material of your code signing key.
    • chrisfosterelli 9y ago
      Not sure if you saw but they did post this: http://blog.npmjs.org/post/169432444640/npm-operational-incident-6-jan-2018 http://blog.npmjs.org/post/169432444640/npm-operational-inci...