3 ms·
> Always use password manager to automatically fill in your credentials Absolutely not. https://www.malwarebytes.com/blog/news/2025/08/clickjack-attack-steals
by esseph 1y ago
> Always use password manager to automatically fill in your credentials
Absolutely not.
https://www.malwarebytes.com/blog/news/2025/08/clickjack-attack-steals-password-managers-secrets https://www.malwarebytes.com/blog/news/2025/08/clickjack-att...
https://thehackernews.com/2025/08/dom-based-extension-clickjacking.html https://thehackernews.com/2025/08/dom-based-extension-clickj...
https://www.intercede.com/the-dangers-of-password-autofill-and-the-risk-of-stealer-logs/ https://www.intercede.com/the-dangers-of-password-autofill-a...
- darthwalsh 1y agoWhat's more likely, the real npm site has a subdomain with XSS (IIRC the issue you linked) or you are manually filling your password into a phishing site? There's strong evidence that the latter is a more common concern.
- esseph 1y agoWhat I'm saying is that autofill is a current method of credential extraction that should be avoided. You don't have to believe me, read the links.