2 ms·

If everybody waits two weeks, then nobody will notice it on the first two weeks.

• dane-pgp 5y ago
  The registry could send an email to the account which uploaded the package saying "Thank you for uploading version 1.2.3 of your-package." which would give them two weeks to think "Wait, I didn't upload a new version." Of course, if the attacker has access to their npm account, they can probably change the email address associated with the account too, so change-of-email requests should send a "Thank you for changing your email address" to the original address. The developer might have difficulty regaining control of the account, but hopefully they could inform the npm security team who could quite quickly confirm that a malicious package had been uploaded, which would be enough to get the malicious package taken down and the account locked.