2 ms·

Previous discussion (from less than 24 hours ago): https://news.ycombinator.com/item?id=29234098 https://news.ycombinator.com/item?id=29234098 It came with the

• lucasyvas 5y ago
  Happy this got a second chance with a better title. I was in the one yesterday and did a double take a few times when I was reading it.
• andai 5y ago
  Quoting globalise83 from the other thread for summing it up perfectly: >"we received a report to our security bug bounty program of a vulnerability that would allow an attacker to publish new versions of any npm package using an account without proper authorization." >"This vulnerability existed in the npm registry beyond the timeframe for which we have telemetry to determine whether it has ever been exploited maliciously. However, we can say with high confidence that this vulnerability has not been exploited maliciously during the timeframe for which we have available telemetry, which goes back to September 2020." >Any version of any npm package published before September 2020 could have been tampered with by anyone aware of that exploit and no-one would be any the wiser. That is pretty bad news.
  • eyelidlessness 5y ago
    No kidding. That’s bad enough news to warrant flagging any release by users not currently authorized to its respective package. At least internally for further analysis, but probably also for maintainers and users to at least have an opportunity to do their own threat assessment.
  • ComodoHacker 5y ago
    Looks like npm is a very troubled asset for MS, which could easily turn into liability.