20 ms·

Hi, yep I got pwned. Sorry everyone, very embarrassing. More info: - https://github.com/chalk/chalk/issues/656 https://github.com/chalk/chalk/issues/656 - ht

• jap 1y ago
  Could happen to anyone, many thanks for addressing this quickly.
• dboreham 1y ago
  Sorry to be dumb, but can you expand a bit on "2FA reset email..." so the rest of us know what not to do?
  • junon 1y ago
    Ignore anything coming from npm you didn't expect. Don't click links, go to the website directly and address it there. That's what I should have done, and didn't because I was in a rush. Don't do security things when you're not fully awake, too. Lesson learned. The email was a "2FA update" email telling me it's been 12 months since I updated 2FA. That should have been a red flag but I've seen similarly dumb things coming from well-intentioned sites before. Since npm has historically been in contact about new security enhancements, this didn't smell particularly unbelievable to my nose. The email went to the npm-specific inbox, which is another way I can verify them. That address can be queried publicly but I don't generally count on spammers to find that one but instead look at git addresses etc The domain name was `npmjs dot help` which obviously should have caught my eye, and would have if I was a bit more awake. The actual in-email link matched what I'd expect on npm's actual site, too. I'm still trying to work out exactly how they got access. They didn't technically get a real 2FA code from the actual, I don't believe. EDIT: Yeah they did, nevermind. Was a TOTP proxy attack, or whatever you'd call it. Will post a post-mortem when everything is said and done.
    • dboreham 1y ago
      I see (I think): they tricked you into entering a TOTP code into their site, which they then proxied to the real names, thereby authenticating as your account. Is that correct?
      • junon 1y ago
        Seems so, yes.
      • sugarpimpdorsey 1y ago
        It only proves that TOTP is useless against phishing.
        • goku12 1y ago
          Every day brings me another reason to ask the question: "Why the hell did they throw away the idea of mutual TLS?". They then went onto invent mobile OTP, HOTP, TOTP, FIDO-U2F and finally came a full cycle by reinventing the same concept, but in a more complex incarnation - Passkeys.
          • deleted 1y ago
            [deleted]
          • quotemstr 1y ago
            Because the tech industry egregore is a middling LLM that gets it context window compacted every generation.
          • tpxl 1y ago
            Works this way for my government and my bank. I was given a cert matching my real name and the login just asks for my cert and pulls me through (with additional 2FA for the bank). Pretty amazing if you ask me.
            • goku12 1y ago
  • diggan 1y ago
    > so the rest of us know what not to do? Can't really tell you what not to do, but if you're not already using a password manager so you can easily avoid phishing scams, I really recommend you to look into starting doing so. In the case of this attack, if you had a password manager and ended up on a domain that looks like the real one, but isn't, you'd notice something is amiss when your password manager cannot find any existing passwords for the current website, and then you'd take a really close look at the domain to confirm before moving forward.
    • withinboredom 1y ago
      This isn’t exactly true. My password manager fails to recognise the domain I’m on, all the time. I have to go search for it and then copy/paste it in. That being said, if you’re making login pages: please, for the love of god, test them with multiple password managers. Oh, and make sure they also work correctly with the browser’s autotranslation. Don’t rely on the label to make form submission decisions ... please.
      • diggan 1y ago
        > This isn’t exactly true. My password manager fails to recognise the domain I’m on, all the time. I have to go search for it and then copy/paste it in. I'd probably go looking for a new password manager if it fails to do one of the basic features they exist for, copy-pasting passwords defeats a lot of the purpose :) > That being said, if you’re making login pages I think we're doomed on this front already. My previous bank still (in 2025!) only allows 6 numbers as the online portal login password, no letters or special characters allowed, and you cannot paste in the field so no password manager works with their login fields, the future is great :)
        • withinboredom 1y ago
          > I'd probably go looking for a new password manager if it fails to do one of the basic features they exist for, copy-pasting passwords defeats a lot of the purpose :) This isn’t the fault of the password managers themselves, but devs not putting the right metadata on their login forms, or havo the password field show only after putting in the email address, causing the password input to fail to be filled, etc.
• nodesocket 1y ago
  What did the phishing email say that made you click and login?
  • junon 1y ago
    That it had been more than 12 months since last updating them. Npm has done outreach before about doing security changes/enhancements in the past so this didn't really catch me. Screenshot here: https://imgur.com/a/q8s235k https://imgur.com/a/q8s235k
    • SSLy 1y ago
      Can you post full message headers somewhere? It'd be interesting which MTA was involved in delivery from the sender's side.
      • junon 1y ago
        Yep - https://gist.github.com/Qix-/c1f0d4f0d359dffaeec48dbfa1d40ee9 https://gist.github.com/Qix-/c1f0d4f0d359dffaeec48dbfa1d40ee...
        • SSLy 1y ago
          let's see the header of interest: Received: from npmjs.help by smtp.mailtrap.live
          • XxgodReixX88 1y ago
            what about it?
        • alexellisuk 1y ago
          How did simply opening this email in something like Gmail or a desktop client result in it being able to compromise NPM packages under your control? I'm just curious - and as a word of warning to others so we can learn. I may be missing some details, I've read most of the comments on the page.
• kidk 1y ago
  Could happen to any of us. Thanks for reacting so quickly!!
• BlackjackCF 1y ago
  Thank you for being quick and upfront about this!
• winwang 1y ago
  Just want to agree with everyone who is thanking you for owning up (and so quickly). Got phished once while drunk in college (a long time ago), could have been anyone. NPM being slowish to get back to you is a bit surprising, though. Seems like that would only make attacks more lucrative.
  • internetter 1y ago
    in general npm does a not-too-great job with these things
    • tripplyons 1y ago
      Remember, NPM stands for Now Part of Microsoft! (Microsoft owns GitHub, which owns NPM.)
      • thayne 1y ago
        Which means they don't have the excuse of being a volunteer effort to not be on top of this. MS has plenty of resources.
        • dabockster 1y ago
          If you're running this kind of infrastructure online these days, you have every right to require payment somehow. Don't work for free.
  • wer232essf 1y ago
    [dead]
    • deleted 1y ago
      [deleted]
  • sneak 1y ago
    Can happen to anyone… who doesn’t use password manager autofill and unphishable 2FA like passkeys. Most people who get phished aren’t using password managers, or they would notice that the autofill doesn’t work because the domain is wrong. Additionally, TOTP 2FA (numeric codes) are phishable; stop using them when U2F/WebAuthn/passkeys are available. I have never been phished because I follow best practices. Most people don’t.
• zachrip 1y ago
  Thanks for sounding the alarm. I've sent an abuse email to porkbun to hopefully get the domain taken down.
  • junon 1y ago
    Thank you, I appreciate it! I did so as well and even called their support line to have them escalate it. Hopefully they'll treat this as an urgent thing; I'd imagine I'm far from the only one getting these.
    • zachrip 1y ago
      It's down, so there's some good news. Probably worth submitting to IC3 as well.
• zachleat 1y ago
  Yo, someone at npm needs to unpublish simple-swizzle@0.2.3 IMMEDIATELY. It’s still actively compromised.
  • junon 1y ago
    It's been almost two hours without a single email back from npm. I am sitting here struggling to figure out what to do to fix any of this. The packages that have Sindre as a co-publisher have been published over but even he isn't able to yank the malicious versions AFAIU. If there's any ideas on what I should be doing, I'm all ears. EDIT: I've heard back, they said they're aware and are on it, but no further details.
    • lambda 1y ago
      They have yanked the bad version of simple-swizzle by now, which was the last of the packages that I was tracking. It took them quite a long time to do so.
    • 9dev 1y ago
      My god. The npm team should urgently review their internal processes. These two hours of neglect will cost a lot of money downstream. At this stage, they act nothing short of irresponsible.
    • dabockster 1y ago
      I haven't published anything to npm in over a decade. But if you still have access to git, a cli, or a browser where the login is cached and you can access it, you should do so and either take the code down or intentionally sabotage/break it.
    • alper 1y ago
      NPM is a Github company and when there was a relatively serious attack in Github Actions a while back there was also pretty much zero response from them. Github is SOC2 compliant, but that of course means nothing really.
  • greatestdevever 1y ago
• quotemstr 1y ago
  Not your fault. Thanks for posting and being proactive about fixing the problem. It could happen to anyone. And because it could happen to anyone that we should be doing a better job using AI models for defense. If ordinary people reading a link target URL can see it as suspicious, a model probably can too. We should be plumbing all our emails through privacy-preserving models to detect things like this. The old family of vulnerability scanners isn't working.
• jacquesm 1y ago
  I hate that kind of email when sent out legitimately. Google does this crap all the time pretty much conditioning their customers to click those links. And if you're really lucky it's from some subdomain they never bothered advertising as legit. Great of you to own up to it.
  • mikeryan 1y ago
    I’ve started ignoring these types of emails and wait to do any sort of credentials reset until I get an alert when I log in (or try to) for just this reason.
  • antod 1y ago
    Atlassian and MS are terrible for making email notifications that are really hard to distinguish from phishing emails. Using hard to identify undocumented random domains in long redirect chains, obfuscating links etc etc.
• pryelluw 1y ago
  Thank you for your service. Please take care and see this as things that happen and not your own personal failure.
• mfedderly 1y ago
  I'm sorry that you're having to go through this. Good luck sorting out your account access. I actually got hit by something that sounds very similar back in July. I was saved by my DNS settings where "npNjs dot com" wound up on a blocklist. I might be paranoid, but it felt targeted and was of a higher level of believability than I'd seen before. I also more recently received another email asking for an academic interview about "understanding why popular packages wouldn't have been published in a while" that felt like elicitation or an attempt to get publishing access. Sadly both of the original emails are now deleted so I don't have the exact details anymore, but stay safe out there everyone.
• hackerindio 1y ago
  Hey, no problem, man. You do a lot for the community, and it's not all your fault. We learn from our mistakes. I was thinking of having a public fake profile to avoid this type of attack, but I'm not sure how it would work on the git tracking capabilities. Probably keeo it only internally for you&NPM ( the real one ) and have some fake ones open for public but not sure, just an obfuscated idea. Thanks for taking the responsibility and working in fixing ASAP. God bless you.
  • Imustaskforhelp 1y ago
    Wow, that's actually kinda genius not gonna lie. Honestly, I would love seeing some 2fa or some other way to prevent pwning. Maybe having a sign up with google with all of its flaws still might make sense given how it might be 2fa. But google comes with its own privacy nightmares.
  • junon 1y ago
    Unfortunately wouldn't have helped. They skimmed my npm-only address directly from the public endpoint.
• joshmanders 1y ago
  Insanely well crafted phishing, godspeed man.
  • junon 1y ago
    Thanks Josh, appreciate it <3
• HelloWorldH 1y ago
  Thank god I misspelled "npm run strat"! Might have been owned.
• komali2 1y ago
  `error-ex` 1.3.3, already removed from npm https://github.com/Qix-/node-error-ex/issues/17 https://github.com/Qix-/node-error-ex/issues/17
• tomkarho 1y ago
  Hang in there buddy. These things happen.
• 33a 1y ago
  We also caught this right away at Socket, https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack https://socket.dev/blog/npm-author-qix-compromised-in-major-... While it sucks that this happened, the good thing is that the ecosystem mobilized quickly. I think these sorts of incidents really show why package scanning is essential for securing open source package repositories.
  • hsbauauvhabzb 1y ago
    [flagged]
    • hsbauauvhabzb 1y ago
      For those interested, points associated with this post spiked to at least 4 then dropped back to one. Take of that what you will.
    • fn-mote 1y ago
      You could at least offer some kind of substantive criticism of the tool (“socket”).
      • hsbauauvhabzb 1y ago
        Do I need any? Automated tools cannot prevent malicious code being injected. While they can make attempts to evaluate common heuristics and will catch low hanging malware, they are not fool proof against highly targeted attacks. Either way, the parent post is clearly ambulance chasing rather than having a productive conversation, which should really be about whether or not automatically downloading and executing huge hierarchal trees of code is absolutely fucking crazy, rather than a blatant attempt to make money off an ongoing problem without actually solving anything.
        • 33a 1y ago
          When we find malware on any registry (npm, rubygems, pypi or otherwise), we immediately report it to the upstream registry and try to get it taken down. This helps reduce the blast radius from incidents like this and mitigates the damage done to the entire ecosystem. You can call it ambulance chasing, but I think this is a good thing for the whole software ecosystem if people aren't accidentally bundling cryptostealers in their web apps. And regarding not copying massive trees of untrusted dependencies: I am actually all for this! It's better to have fewer dependencies, but this is also not how software works today. Given the imperfect world we have, I think it's better to at least try to do something to detect and block malware than just complain about npm.
• winterqt 1y ago
  Thank you for the swift and candid response, this has to suck. :/ > The author appears to have deleted most of the compromised package before losing access to his account. At the time of writing, the package simple-swizzle is still compromised. Is this quote from TFA incorrect, since npm hasn’t yanked anything yet?
  • junon 1y ago
    Quote is probably added recently. Not entirely correct as I have not regained access; nothing happening to the packages is of my own doing. npm does appear to have yanked a few, slowly, but I still don't have any insight as to what they're doing exactly.
• naikrovek 1y ago
  mistakes happen. owning them doesn't always happen, so well done. phishing is too easy. so easy that I don't think the completely unchecked growth of ecosystems like NPM can continue. metastasis is not healthy. there are too many maintainers writing too many packages that too many others rely on.
• sim7c00 1y ago
  man. anyone and everyone can get fished in a targeted attack. good luck on the cleanup and thanks for being forward about it. want to stress everyone it can happen to. no one has perfect opsec or tradecraft as a 1 man show. its simply not possible. only luck gets one through and that often enough runs out.
• rootlocus 1y ago
  > Made the mistake of clicking the link instead of going directly to the site like I normally would (since I was mobile). Does anyone know how this attack works? Is it a CSRF against npmjs.com?
  • smeijer87 1y ago
    Probably just a fake site.
  • junon 1y ago
    That was the low-tech part of their attack, and was my fault - both for clicking on it and for my phrasing. It wasn't a single-click attack, sorry for the confusion. I logged into their fake site with a TOTP code.
    • yard2010 1y ago
      This is a clear example that this can happen to anyone. Sorry for what you're going through.
      • SchemaLoad 1y ago
        This is why Passkeys are getting pushed right now. They make it physically impossible to sign in to a phishing site.
  • veber-alex 1y ago
    Fake site. You login with your credentials, the attacker logins to the real site. You get an SMS with a one time code from the real site and input it to the fake site. The attacker takes the code andc finishes the login to the real site.
• Cthulhu_ 1y ago
  Tbh, it's not your fault per se; everybody can fall for phishing emails. The issue, IMO, lies with npmjs which publishes to everyone all at the same time. A delayed publish that allows parties like Aikido and co to scan for suspicious package uploads first (e.g. big changes in patch releases, obfuscated code, code that intercepts HTTP calls, etc), and a direct flagging system at NPM and / or Github would already be an improvement.
  • junon 1y ago
    Being able to sign releases would help, too. I would happily have that enabled since I'm always publishing from one place.
    • OptionOfT 1y ago
      Provenance can be added to NPM https://docs.npmjs.com/generating-provenance-statements https://docs.npmjs.com/generating-provenance-statements So if the hacker did an npm publish from local it would show up.
    • Yoric 1y ago
      Wouldn't they have been able to change your key if they had compromised your entire npm account? Also, junon.support++ – big thanks for being clear about all this.
      • junon 1y ago
        Yes though in theory my public key would have been published elsewhere at least for verification. Valid point though, yes they would have been able to do that.
      • veber-alex 1y ago
        Hmm, maybe npm needs to do the same thing the iPhone does now. If you change your key you can't use it for like 12 hours or something?
      • dabockster 1y ago
• cyanydeez 1y ago
  maybe you should work with feross to make a website-api that simply gives you a "true/false" on "can I safely update my dependencies right now" that gives an outofband way to mark the current or all versions thereof, of compromised packages.
• aftbit 1y ago
  Didn't your password manager notice that npmjs dot help was not a legit domain and avoid auto-filling there?
  • johanyc 1y ago
    https://news.ycombinator.com/item?id=45175125 https://news.ycombinator.com/item?id=45175125
• cataflam 1y ago
  Hey, you're doing an exemplary response, transparent and fast, in what must be a very stressful situation! I figure you aren't about to get fooled by phishing anytime soon, but based on some of your remarks and remarks of others, a PSA: TRUSTING YOUR OWN SENSES to "check" that a domain is right, or an email is right, or the wording has some urgency or whatever is BOUND TO FAIL often enough. I don't understand how most of the anti-phishing advice focuses on that, it's useless to borderline counter-productive. What really helps against phishing : 1. NEVER EVER login from an email link. EVER. There are enough legit and phishing emails asking you to do this that it's basically impossible to tell one from the other. The only way to win is to not try. 2. U2F/Webauthn key as second factor is phishing-proof. TOTP is not. That is all there is. Any other method, any other "indicator" helps but is error-prone, which means someone somewhere will get phished eventually. Particularly if stressed, tired, or in a hurry. It just happened to be you this time. Good luck and well done again on the response!
  • diggan 1y ago
    Or you know, get a password manager like the rest of us. If your password manager doesn't show the usual autofill, since the domain is different than it should, take a step back and validate everything before moving on. Have the TOTP in the same/another password manager (after considering the tradeoffs) and that can also not be entered unless the domain is right :)
    • cataflam 1y ago
      I mostly agree and I do use one. You only need read the whole thread however to see reasons why this would sometimes not be enough: sometimes the password manager does not auto-fill, so the user can think it's one of those cases, or they're on mobile and they don't have the extension there, or... As a matter of fact, he does use one, that didn't save him, see: https://news.ycombinator.com/item?id=45175125 https://news.ycombinator.com/item?id=45175125
      • eviks 1y ago
        > sometimes the password manager does not auto-fill So pick one that does? That's like its top 2 feature > he does use one He doesn't since he has no autofill installed, so loses the key security+ convenience benefit of automatch
• AsmodiusVI 1y ago
  You're doing what you can, it's not easy. Thanks for handling this so well.
• SkyPuncher 1y ago
  The fact that NPMs entire ecosystem relies on this not happening regularly is very scary. I’m extremely security conscious and that phishing email could have easily gotten me. All it takes is one slip up. Tired, stressed, distracted. Bokm, compromised
• g42gregory 1y ago
  I am not very sophisticated npm user on MacOS, but I installed bunch of packages for Claude Code development. How do we check if computer has a problem? Do we just run: npm list -g #for global installs npm list #for local installs And check if any packages appear that are on the above list? Thanks!
  • greatestdevever 1y ago
    How I do it is, run npm list --all then check the completely dependency tree to find out if anywhere I am using the vulnerable package.
• Goofy_Coyote 1y ago
  Absolutely best response here. Folks from multi-billion dollar companies with multimillion dollar packages should learn a few things from this response.
• sidcool 1y ago
  Thanks for your response. But this does call for preventing a single point of failure for security.
• senectus1 1y ago
  we're only human mate, great job responding to it! thanks for your efforts!
• svendroevskaeg 1y ago
  So by "Just NPM is affected" does that mean yarn is unaffected?
  • junon 1y ago
    No, anything that connects to npm as an authoritative source for packages. Yarn, pnpm, and npm clients all do.
• baloki 1y ago
  Happens to the best of people. Appreciate you’re fast and open response.
• n8m8 1y ago
  Thanks for leaving a transparent response with what happened, how you responded, what you're doing next, and concisely taking accountability Great work!
• mkfs 1y ago
  The 2FA/TOTP security theater was partly to blame for this.
  • lurker_jMckQT99 1y ago
    How so? Has the author mentioned somewhere that he was tricked into providing 2FA codes / had any sort of 2FA enabled at all?
    • mkfs 1y ago
      A spearphishing email telling them they had to update their 2FA was the vector.
• greatestdevever 1y ago
  insanely well-crafted. i mean, it's something bad that happened but one must recognise the wit of this attack.
• greatestdevever 1y ago
  Hey, new dev here. Sorry if this is a common knowledge and I am asking a stupid question. How does you getting phished affect these NPM packages? aren't these handled by NPM or the developers of them?
  • p91paul 1y ago
    The guy is actually the maintainer of those packages. So whoever got his credentials became able to perform releases on those packages. NPM itself does not build any package, it's just a place where people can publish stuff
  • handstitched 1y ago
    OP is the developer & maintainer of the affected packages, so the attacker was able to use their phished credentials to upload compromised versions to NPM.
    • greatestdevever 1y ago
      oh! understood. thanks.
• goat0913 1y ago
  be careful!