4 ms·
> That means every single package published between the vulnerable packages and the mass token invalidation is suspect and should be unpublished until it can be
by _greim_ 8y ago
> That means every single package published between the vulnerable packages and the mass token invalidation is suspect and should be unpublished until it can be audited.
I wonder how many packages in fact got published during that nine-hour time window. Does anyone know what kind of number that would be?
- thenewwazoo 8y agoI'm currently dumping the npm db right now to figure that out. eslint-scope 3.7.2 was published on 2018-07-12T10:40:00.478Z eslint-config-eslint 5.0.2 was published on 2018-07-12T09:49:24.957Z tokens were invalidated at 2018-07-12 12:30 UTC
- _greim_ 8y ago> tokens were invalidated at 2018-07-12 12:30 UTC I'm reading it as tokens created before 2018-07-12 12:30 UTC were invalidated, but the invalidation itself happened on 2018-07-12 18:42 UTC according to eslint's post-mortem[1]. I think the latter is the more relevant date. [1] https://eslint.org/blog/2018/07/postmortem-for-malicious-package-publishes https://eslint.org/blog/2018/07/postmortem-for-malicious-pac...
- deleted 8y ago[deleted]
- watson 8y agoIf I understand the npm incident report correctly, the answer is none: > We determined that access tokens for approximately 4,500 accounts could have been obtained before we acted to close this vulnerability. However, we have not found evidence that any tokens were actually obtained or used to access any npmjs.com account during this window. Source: https://blog.npmjs.org/post/175824896885/incident-report-npm-inc-operations-incident-of https://blog.npmjs.org/post/175824896885/incident-report-npm...
- _greim_ 8y agoThe wording is pretty vague, I guess intentionally, but saying "we found no evidence..." isn't as confidence-inspiring as if they'd said "we determined that no...".