3 ms·
How do you add a new version to npm? Was the devs account hacked or how does that work?
by jcfrei 5y ago
How do you add a new version to npm? Was the devs account hacked or how does that work?
- SahAssar 5y agoThe most common ways these things seem to happen is either password reuse with no 2fa or that the npm token (in ~/.npmrc) was harvested by another compromised package/program. IIRC there were a few that were due to phishing too.
- jacques_chester 5y agoAlmost certainly one of these. It's not a typosquatting attack, since it's an existing package. And it's not a repository compromise, since they had to create new versions instead of silently altering an existing version.
- jart 5y agoIt's been suggested a recent Travis CI breach was responsible. https://github.com/veged/coa/issues/99#issuecomment-961696885 https://github.com/veged/coa/issues/99#issuecomment-96169688...