junon

18 ms·

391.
by junon 1y ago
A demonstration as a comment on the gist would probably work! I'd love to see that
392.
by junon 1y ago
The attack that hit my packages two weeks ago was a patch release, taking advantage of this exact assumption. Wasn't a Post-Install script either. With all of the latest in automated scanning and whatnot, this is more or less a moot po
393.
by junon 1y ago
Gave up at 33, the brands one. That's really cute.
394.
by junon 1y ago
I would do this just for the meme of it, complete with screenshot, if it weren't for the fact it'd be huge and take up a ton of filament.
395.
by junon 1y ago
Yet another "it's okay if I move there, but now that they have moved there, it sucks and is 'foreign'" take. It just reads like thinly veiled racism.
396.
by junon 1y ago
This is going to become an issue for a lot of managers, not just npm. Npm is clearly a very viable target right now, though. They're going to get more and more sophisticated.
397.
by junon 1y ago
It's unrelated in every observable technical way, but related in that it's a bit crazy how often this is happening to npm lately. I'm glad it wasn't this particular attack that hit me last week.
398.
by junon 1y ago
Lock files wouldn't work if they were locking transitive dependencies; otherwise the version solver would not have any work to actually do and you'd have many, many versions of the same package rather than a few versions that sati
399.
by junon 1y ago
Cubesats in most cases must have documented materials that are burnt up in the atmosphere upon reentry, for this exact reason. They don't stay up there forever.
400.
by junon 1y ago
TIL you're the founder of Socket. Thank you (and your team) for the help last week.
401.
by junon 1y ago
I didn't like working with posthog when I had to because the level of analytics they do goes against my personal ethics viewpoint but I do have to say they do very good technical work. The landing page is a good reflection of the ski
402.
by junon 1y ago
I think you are missing a lot of information I've posted elsewhere in this thread and the original HN post. I didn't minimize anything; I would hope most agree that if anything I've maximized the message as much as I possibly
403.
by junon 1y ago
Not wanting to see people murdered for their opinions is a belief that can coexist with knowing the other side might want to kill me for mine.
404.
by junon 1y ago
> the from: address in every email is an arbitrary and unverified text string that the sender provides DKIM et al came back clean. As for URL scheme, I mean the format and layout of URLs - because it was an MITM attack, they matched 1:1.
405.
by junon 1y ago
> the link in the email went to an obviously invalid domain, hovering the mouse cursor over the link in the email would have made this immediately clear, so even clicking that link should have never happened in the first place. red flag
406.
by junon 1y ago
This wasn't a repository takeover. I do sign my commits.
407.
by junon 1y ago
These were different. The vulnerable packages wouldn't have caused an API exploit vector except in the most bizarre of edge cases I suppose.
408.
by junon 1y ago
Anecdotally throughout all this, contacting npm got me a response from githubsupport.com. I had to double check if that was even real.
409.
by junon 1y ago
Didn't expect things to grow how they have, that's for sure! Hope you've been well :)
410.
by junon 1y ago
That's exactly what I do, and have caught quite a lot of other phishing emails this way. They queried my npm email via the public API and sent it there.
411.
by junon 1y ago
Authentication-Results: aspmx1.migadu.com; dkim=pass header.d=smtp.mailtrap.live header.s=rwmt1 header.b=Wrv0sR0r; dkim=pass header.d=npmjs.help header.s=rwmt1 header.b=opuoQW+P; spf=pass (aspmx1.migadu.com: d
412.
by junon 1y ago
`Symbol` wasn't supported when I wrote `is-arrayish`. Neither were spreads. It was meant to be used with DOM lists or the magical `arguments` variable.
413.
by junon 1y ago
Hi, said person who clicked on the link here. Been wanting to post something akin to this and was going to save it for the post mortem but I wanted to address the increase in these sort of very shout-ey comments directed toward me. > Wha
414.
by junon 1y ago
Even if I sunset those packages, they'd still be downloaded and used in perpetuity, and certainly for many years afterward, even by popular packages, and even by such packages that have removed them in newer versions. Even if I had don
415.
by junon 1y ago
This is why I haven't bothered with them (the browser extensions; I have used password managers for years and years) and thus why they weren't there to protect against the attack.
416.
by junon 1y ago
We probably don't disagree, to be honest. Some of these packages shouldn't exist, I'll be the first to say it.
417.
by junon 1y ago
No, anything that connects to npm as an authoritative source for packages. Yarn, pnpm, and npm clients all do.
418.
by junon 1y ago
I'd be curious what those edge cases are, as a maintainer of chalk.
419.
by junon 1y ago
I use a password manager. I was mobile, the autofill stuff isn't installed as I don't use it often on my phone. In 15 years of maintaining OSS, I've never been pwned, phished, or anything of the sort. Thank you for your input
420.
by junon 1y ago
I wrote it 10 years ago, I think before Node was v1, and forgot about it for a long time. This was back before we had spreads, classes, typescript, and had to use DOM arrays and other weird structures, and where `arguments` wasn't an a

More ›