Post Ay0ErpQb2bZfTS8xA8 by [email protected] | |
More posts by [email protected] | |
Post #Ay05XRpABrqCtBqDq4 by [email protected] | |
0 likes, 6 repeats | |
Malicious javascript compromise on npmjs.comThese packages, about a billion dow… | |
Post #Ay05imGOXQjvSvyskK by [email protected] | |
0 likes, 0 repeats | |
Example change and download stats on one of the 12 packages changed, incident s… | |
Post #Ay05prMFzlH7IF6GKe by [email protected] | |
0 likes, 0 repeats | |
Example copy of one of the inserted JS: https://pastebin.com/bwLZrq02 | |
Post #Ay0683LYA0wnghRcps by [email protected] | |
0 likes, 0 repeats | |
Just reported to NPM, they work on it. | |
Post #Ay06CEP2zkdd8Y4ZkG by [email protected] | |
0 likes, 0 repeats | |
Derek's caught it too https://infosec.exchange/@derekheld/115169311485030806 | |
Post #Ay06eumx04DOhYvlqq by [email protected] | |
0 likes, 1 repeats | |
@GossiTheDog deobfuscated a bit : https://pastebin.com/6L1hKKjj | |
Post #Ay06kGlKjGBqIgjAQK by [email protected] | |
0 likes, 0 repeats | |
It's a cryptocurrency wallet drainer, RIP a load of devops dudes crypto. | |
Post #Ay06x9IZn4wGusPz1s by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog and people still try to claim that JavaScript is without merit! | |
Post #Ay07kX9DuOqP4ZakYy by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog it feels like it is a good idea to delay artifact downloads for a … | |
Post #Ay08Av8lKMYf0txTyi by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog wallet driver? | |
Post #Ay08Gdy45Tw5UWgS5g by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog is, is this like, can i like tell my bosses i need to go home and … | |
Post #Ay08PP1j0UVLl7ZXgO by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog @bjoreman you're the no dependency guy, right? | |
Post #Ay091K83fJUfZZcISG by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Josh Junon posted on Bluesky. Fake 2FA reset e-mailhttps://bsky.ap… | |
Post #Ay09EfYvHvN7oNXve4 by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog looks like https://www.npmjs.com/~qixso lucky they didn't comp… | |
Post #Ay09NmXMj0q63AAA9w by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog is-arrayish, it has 9 lines of code ☠️ | |
Post #Ay09lci6ubdUWUYc6a by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog wow, Pastebin just tried to give me malware while trying to view m… | |
Post #Ay09qLXy9YcSjt49Tc by [email protected] | |
0 likes, 1 repeats | |
@GossiTheDog Seems like they are fixing the problem by removing affected versio… | |
Post #Ay09z1uEXy6CQjcWsC by [email protected] | |
0 likes, 0 repeats | |
NPM on it, some packages nuked, more being nuked | |
Post #Ay0APyCkPtC2ll7taK by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog I was using some of those 😿 | |
Post #Ay0AVBjXXmLSAzx92e by [email protected] | |
0 likes, 0 repeats | |
If you want an idea of scale of trojan attempt - 'color' alone had 32m … | |
Post #Ay0An3kZxpWwd4xcUS by [email protected] | |
0 likes, 1 repeats | |
@GossiTheDog is this a new attack vector? Typically, I've seen attackers us… | |
Post #Ay0B7jJH9jQrJe2uv2 by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog We could see that coming for a long time 😢. In a text I publish… | |
Post #Ay0BAHK7fHzTO1epAu by [email protected] | |
0 likes, 0 repeats | |
additional backdoored packagesansi-stylesdebugchalksupports-colorstrip-ansiansi… | |
Post #Ay0CS9SritNMB9pjJQ by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog now our #SBOMs will be tested. | |
Post #Ay0CobMyeZlf5zmgOO by [email protected] | |
0 likes, 1 repeats | |
Weekly download stats for impacted packages prior to incidentansi-styles (371.4… | |
Post #Ay0CrSFf0i5LgYiq3s by [email protected] | |
0 likes, 1 repeats | |
@GossiTheDog Whoever could have predicted that downloading 10GB of third party … | |
Post #Ay0CvRWBgB4IZLM1c8 by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog well if all they got was crypto.. nothing of value was lost.. | |
Post #Ay0DI2jQ096MM5JsFE by [email protected] | |
0 likes, 0 repeats | |
Phishing email sent to maintainers, they basically targeted people with 2FA by … | |
Post #Ay0DTZLN5fhsgYZGWu by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Ooh, please change your retina every three months...It's a pre… | |
Post #Ay0DVLJ2FlCLjAJxA0 by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog It's incredible that high profile targets like npm or GitHub S… | |
Post #Ay0ErpQb2bZfTS8xA8 by [email protected] | |
0 likes, 0 repeats | |
@yetzt @GossiTheDog or did they? https://github.com/debug-js/debug/issues/1005 | |
Post #Ay0EthydiLjMwcxmKW by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog How do you drain a crypto wallet with JavaScript? | |
Post #Ay0EyogsBIsJDK5Z9E by [email protected] | |
0 likes, 0 repeats | |
@spzb @GossiTheDog oof | |
Post #Ay0F0D5IyDWBA0BIAa by [email protected] | |
0 likes, 1 repeats | |
@GossiTheDog That's a new one. (Too bad no alt text so no boost.)Maybe less… | |
Post #Ay0F2YGfBNlBRDbuVM by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Holy hell, these are some widely used packages. I've found ton… | |
Post #Ay0F2y5ZBGKfWKcPom by [email protected] | |
0 likes, 0 repeats | |
@haagen @GossiTheDog Philosophically: absolutely 😊 | |
Post #Ay0FCUuKWxVRucuHr6 by [email protected] | |
0 likes, 0 repeats | |
@tomw @GossiTheDog From now on I'm only going to use code I can type in fro… | |
Post #Ay0GEoxP3dZ2d113Jo by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog eli5: in what way are users affected and in what way the site and … | |
Post #Ay0GyBPIR6iXHph2CO by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog you mean to tell me that having dependencies on all of the librari… | |
Post #Ay0H98GwQoU4kY0Rwe by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog There's not a lot else to do in Skegness | |
Post #Ay0HDjRm9tUbCgGcts by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog There are bike sheds in Skegness?Painted what colour? | |
Post #Ay0HJKc3P8tZv2kEb2 by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog all you gotta do is find a few nerve points. | |
Post #Ay0HmpZTNgagKgbV0C by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog But, but, but... They said 2FA prevented phishing!When is 2FA not … | |
Post #Ay0I2aJHtB9zdPXruq by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDogSee also the discussions on Git ML about adding Rust, where apparen… | |
Post #Ay0IR5fSxASpq4bWsK by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog ...phew, nothing dangerous then.(Yeah yeah, I know they could swap… | |
Post #Ay0J0cfIGKJIJUSzxY by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog That's Skegness near Pyongyang, right? | |
Post #Ay0K0kEYDpi3k1a24G by [email protected] | |
0 likes, 1 repeats | |
@GossiTheDog the trend in npm to use trivial libraries, i.e.ones you can replac… | |
Post #Ay0KIMoo1BYcKgwPBY by [email protected] | |
0 likes, 1 repeats | |
@GossiTheDog the typical “I want the benefit but I don’t want to deal with … | |
Post #Ay0M2bPKCzjYr3dJgm by [email protected] | |
0 likes, 0 repeats | |
@unlambda @GossiTheDog Uhg. Why would folks keep compromise commits in history.… | |
Post #Ay0M2dZg9TCjZkUc6a by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Do you have a list of the compromised versions?A few of these, whe… | |
Post #Ay0M2dhpf9j5z2J7oW by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Here's my best attempt at a list of the bad versions:- support… | |
Post #Ay0M2eE5jDWxb5Ot60 by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Also, holy hell the left-pad nature of some of these deps. Here… | |
Post #Ay0M3KnfRKwZdaMtNY by [email protected] | |
0 likes, 0 repeats | |
@leoluk @GossiTheDog Draconian systems that limit who can write and publish cod… | |
Post #Ay0M3wbasfrgt90mps by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog That's a clever phish.It looks similar to requests that compan… | |
Post #Ay0M9VJnFLcRzqKwUK by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Good ol; Skeggy! | |
Post #Ay0MAFULaROTBtd1KC by [email protected] | |
0 likes, 0 repeats | |
@alienghic @GossiTheDog Yep, I blame all the incompetent enterprise policies fo… | |
Post #Ay0MDXdcZ01cLjXJ6O by [email protected] | |
0 likes, 0 repeats | |
@tautology @GossiTheDog With Deno it’s a lot easier to add fewer dependencies… | |
Post #Ay0MHcp3EKUpaRpVXk by [email protected] | |
0 likes, 0 repeats | |
@rabc @GossiTheDog Fuck micro-dependency shit. | |
Post #Ay0MMHl8yA5bi1Dy4m by [email protected] | |
0 likes, 0 repeats | |
@dalias @GossiTheDog Security Keys aren't draconian, they're easy to us… | |
Post #Ay0MMxRPztGaz0JoA4 by [email protected] | |
0 likes, 0 repeats | |
@mattb @GossiTheDog node is a platform for running javascript as a language on … | |
Post #Ay0MNRhPUzsspI20Fk by [email protected] | |
0 likes, 0 repeats | |
@Amgine @GossiTheDog It’s hard to tell after 57 years. | |
Post #Ay0NjKJTjy5IFBppWy by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDogThe worst part is like half the libraries that get phished these da… | |
Post #Ay0OIPuCwKoLiwkNFI by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog I have never read a better description of vibe coding to date. | |
Post #Ay0OaC9YoFsgHgPCAi by [email protected] | |
0 likes, 1 repeats | |
@dalias @leoluk @GossiTheDog IBM has a vetted repository for z/OS, once again s… | |
Post #Ay0Oji17i3hRiMzmvw by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog @syklemil I would say z/OS runs the world economy m, HPE Nonstop h… | |
Post #Ay0PQy7Zi8SS72doLQ by [email protected] | |
0 likes, 1 repeats | |
@GossiTheDog This feels obvious, yet it seems that in light of the current even… | |
Post #Ay0QfTwGJKD6njplLM by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Looks like there's a full list on the orange site: https://new… | |
Post #Ay0QihZq3n6ty6sg9w by [email protected] | |
0 likes, 0 repeats | |
@mattb @GossiTheDog Affected websites would largely run fine but if they were h… | |
Post #Ay0SPtMYDVjuvYp9vc by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog OK...so I just had a wallet drained. I'm still trying to figur… | |
Post #Ay0TCfSShdH9zaqZyi by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog it didn’t even occur to me how much more impactful some of the n… | |
Post #Ay0TImeyq5U64AcQbo by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Also, all of that volunteer time isn't acknowledged by the com… | |
Post #Ay0UKzLSkMJRwT6YO8 by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog did they push to a new version or just updated current versions? (… | |
Post #Ay0UsuuxiLH63Yt6Bs by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog "kindly" 🚩 | |
Post #Ay0Vul9h56piJQDkf2 by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Yep...this attack is massive. If you use crypto, do not make any t… | |
Post #Ay0W5YvgsRjZa0p1qy by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog those early node and npm folks were trying their best, but if some… | |
Post #Ay0WSoPHV0cYF4kVXM by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Obligatory: https://xkcd.com/2347/ | |
Post #Ay0XiduIP9MOGVMuG0 by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog On a "side note": I always thought it was a great idea t… | |
Post #Ay0Xv6gXEaeizfsKcy by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog vibe-code honeypots? | |
Post #Ay0ZH7i4ClygUrebho by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog deep irony: go to that pastebin page on an ipad and it brings up a… | |
Post #Ay0ZX8NVUIYTCefi1Q by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Wait, are you saying that they used a link in an email to go to re… | |
Post #Ay0ZezPoh8lliqUvjc by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Skellige, not Skegness. Hope that helps! | |
Post #Ay0a3RUVxfJ9kQM5Wy by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog A list of vulnerable integrity hashes would be extremely useful - … | |
Post #Ay0aI9BaIo3nJoVqds by [email protected] | |
0 likes, 0 repeats | |
This npmjs phishing email led to npmjs.help. This site was a one-on-one copy of… | |
Post #Ay0anjZj3cmR9grm6q by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog CRC and GPG are a thing, right? How hard can it be to guarantee au… | |
Post #Ay0b9Zp7zhcjHYUC6C by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Even I got that email and I haven't touched npm since about 20… | |
Post #Ay0f19LyvQIQgd5evA by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Now if only there was a song about that : https://suno.com/song/9f… | |
Post #Ay0fMh5WhCxfOTfNku by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog strongly suspect that you are underestimating the actual number of… | |
Post #Ay0fOBRhJRMRpskO5Q by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Know we know npm is hosted in Nebraska.https://xkcd.com/2347/ | |
Post #Ay0fwiKdY6rFfyuTpI by [email protected] | |
0 likes, 1 repeats | |
@GossiTheDog Help a dumb security guy out? I haven't been a developer since… | |
Post #Ay0g7yFSiDSSE3rCfQ by [email protected] | |
0 likes, 0 repeats | |
@alienghic @GossiTheDog I’ve never seen a legitimate 2FA expiration, only pas… | |
Post #Ay0g7yNcDtyodLfiNM by [email protected] | |
0 likes, 0 repeats | |
@ShadSterling @GossiTheDog I haven't seen a 2 factor authentication rollove… | |
Post #Ay0g8WbywzfqnkefUO by [email protected] | |
0 likes, 0 repeats | |
@zarchasmpgmr @GossiTheDog @syklemil | |
Post #Ay0gBoVIsrXrA76DOy by [email protected] | |
0 likes, 0 repeats | |
@Amgine @GossiTheDog springgreen | |
Post #Ay0gLHYSF7qnrs5WJE by [email protected] | |
0 likes, 0 repeats | |
@stevel @GossiTheDog pastebin.com is nothing more than a malware distribution s… | |
Post #Ay0gaEWjmYHgozPjpg by [email protected] | |
0 likes, 0 repeats | |
@leoluk @GossiTheDog Mandating having a "something you have" is draco… | |
Post #Ay0gaEz656yAEwgO2K by [email protected] | |
0 likes, 0 repeats | |
@leoluk @GossiTheDog We should not be placing the burden of "users don'… | |
Post #Ay0gaFV0AUURptbrlY by [email protected] | |
0 likes, 1 repeats | |
@leoluk @GossiTheDog For the most part, none of these packages have any need fo… | |
Post #Ay0gaGBXcKW9xpVq4W by [email protected] | |
0 likes, 0 repeats | |
@dougwade @GossiTheDog When deep in a hole stop diggingNpm should be deprecated… | |
Post #Ay0glIA6bjn3HS6LnU by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog iirc, a typical CRA app started at about 1k packages. | |
Post #Ay0gq7DeihI4n33uLI by [email protected] | |
0 likes, 0 repeats | |
@dalias @leoluk @GossiTheDog at the very least, lets check GPG signatures rathe… | |
Post #Ay0gt6jGzxVO8gHGoC by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog "and an app is farted out" 😂 | |
Post #Ay0hMrHP0ITguWQZ16 by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Whoa! | |
Post #Ay0hc8i4TtV9JTBjYu by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog is-arrayish. WTF? | |
Post #Ay0iLLYPZcGgBDE69w by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog #doubleplusungood | |
Post #Ay0kN3SY1GdUY2QT68 by [email protected] | |
0 likes, 1 repeats | |
@Standard_Phil @GossiTheDog Every time npm fetches the source code counts as a … | |
Post #Ay0nin93ek7IBQMlua by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog we have done that looooong before agentic coding was a thing. And … | |
Post #Ay0rQCfmv4M5fg4F4i by [email protected] | |
0 likes, 1 repeats | |
@GossiTheDog ... the guy from Skegness: | |
Post #Ay1D0tXP7nCc4nU0em by [email protected] | |
0 likes, 0 repeats | |
@Standard_Phil an npm module gets downloaded if it doesn’t exist in the requi… | |
Post #Ay1D0tdmk4J4OaT6bQ by [email protected] | |
0 likes, 1 repeats | |
@_nd_ Thanks Andreas. Sounds like these are mainly developer activities then, n… | |
Post #Ay1b2cid1fevOO5eqm by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog shucks, I have the following libraries in #Convo 😳- color-conve… | |
Post #Ay1gZWoOVaaiOoISSu by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog This post is gold, I had such a good laugh. | |
Post #Ay1gyAYcO3smcMfR0y by [email protected] | |
0 likes, 0 repeats | |
@lanodan @leoluk @GossiTheDog @stevel This. The only real solution is not putti… | |
Post #Ay1gyAhTr6yJ3qoVpQ by [email protected] | |
0 likes, 0 repeats | |
@lanodan @leoluk @GossiTheDog @stevel Also let's not forget that no 2FA or … | |
Post #Ay1h53XervpYt2VCIi by [email protected] | |
0 likes, 0 repeats | |
@tautology @GossiTheDog Why do people do this? | |
Post #Ay1hO3bGsOfSZNFiTo by [email protected] | |
0 likes, 0 repeats | |
@dalias @lanodan @leoluk @GossiTheDog I'd add "not need to download ev… | |
Post #Ay1heZ8HPJv6zzZ1SS by [email protected] | |
0 likes, 0 repeats | |
@lanodan @leoluk @GossiTheDog @stevel @piggo Uncomfortable truth: LPMs are grow… | |
Post #Ay1hwPp4l9JpL05oiO by [email protected] | |
0 likes, 0 repeats | |
@etchedpixels @GossiTheDog @Amgine this sounds like a shibboleth and i live for… | |
Post #Ay1hxTDRd6Qw9OzhDs by [email protected] | |
0 likes, 0 repeats | |
@joby @leoluk @GossiTheDog Or even just copy&paste the 9 lines of code you … | |
Post #Ay1hzipAZKCX8eiHp2 by [email protected] | |
0 likes, 0 repeats | |
@lanodan @leoluk @GossiTheDog @dalias @stevel don't you see the actual prob… | |
Post #Ay1i95isnlOOlPEyBc by [email protected] | |
0 likes, 0 repeats | |
@emory The Law of Triviality - https://en.wikipedia.org/wiki/Law_of_triviality … | |
Post #Ay1i9IC2RBqPRIyQIS by [email protected] | |
0 likes, 0 repeats | |
@tautology @GossiTheDog I am not an npm user (or full time developer) but I fin… | |
Post #Ay1i9PnWAEz31ZYxBg by [email protected] | |
0 likes, 0 repeats | |
@sawaba @GossiTheDog npm install scripts are definitely the most common way. B… | |
Post #Ay1liC0vheskGz6wSm by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog I finally got around to writing about the entire mess (not just th… | |
Post #Ay1maSqJLmoQ6V1Tai by [email protected] | |
0 likes, 0 repeats | |
@dalias @leoluk That approach doesn't work. Suppose you're on version X… | |
Post #Ay2BRUS4UpznLGVDdo by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog I understand the concept, I’m just saying I can’t recall many … | |
Post #Ay2TBO10SS1lvAJW9g by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog the one guy in Skegness | |
Post #Ay2TTVmKKi99D85fKC by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog is-arrayish, I can't even | |
Post #Ay2UjTABvJv5ghQT0i by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog178 is either a crazy low estimate or you're only considering d… | |
Post #Ay2dB7gKBWLuny9YVU by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog in case anyone is interested in this sort of thing i've been h… | |
Post #Ay2fp4ue6Cfni021aK by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Crazy work! | |
Post #Ay3wNzIakuZArFrOSm by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Bless him, he’s a wonderful, extremely smart and very talented g… | |
Post #Ay7nczoczjkhqhlZGS by [email protected] | |
0 likes, 0 repeats | |
@dalias @GossiTheDog By "history" I meant package history, not Git hi… | |
Post #Ay8KTYJFBpI2QBBv6G by [email protected] | |
0 likes, 1 repeats | |
@GossiTheDog Is Skegness the sister city to Buttscratch, Wyoming? | |
Post #AyAuQZwCfFXFGjDPay by [email protected] | |
0 likes, 0 repeats | |
@GossiTheDog Links in email shouldn't be clickable without the user getting… |