Introduction
Introduction Statistics Contact Development Disclaimer Help
Post Ay0OaC9YoFsgHgPCAi by [email protected]
More posts by [email protected]
Post #Ay05XRpABrqCtBqDq4 by [email protected]
0 likes, 6 repeats
Malicious javascript compromise on npmjs.comThese packages, about a billion dow…
Post #Ay05imGOXQjvSvyskK by [email protected]
0 likes, 0 repeats
Example change and download stats on one of the 12 packages changed, incident s…
Post #Ay05prMFzlH7IF6GKe by [email protected]
0 likes, 0 repeats
Example copy of one of the inserted JS: https://pastebin.com/bwLZrq02
Post #Ay0683LYA0wnghRcps by [email protected]
0 likes, 0 repeats
Just reported to NPM, they work on it.
Post #Ay06CEP2zkdd8Y4ZkG by [email protected]
0 likes, 0 repeats
Derek's caught it too https://infosec.exchange/@derekheld/115169311485030806
Post #Ay06eumx04DOhYvlqq by [email protected]
0 likes, 1 repeats
@GossiTheDog deobfuscated a bit : https://pastebin.com/6L1hKKjj
Post #Ay06kGlKjGBqIgjAQK by [email protected]
0 likes, 0 repeats
It's a cryptocurrency wallet drainer, RIP a load of devops dudes crypto.
Post #Ay06x9IZn4wGusPz1s by [email protected]
0 likes, 0 repeats
@GossiTheDog and people still try to claim that JavaScript is without merit!
Post #Ay07kX9DuOqP4ZakYy by [email protected]
0 likes, 0 repeats
@GossiTheDog it feels like it is a good idea to delay artifact downloads for a …
Post #Ay08Av8lKMYf0txTyi by [email protected]
0 likes, 0 repeats
@GossiTheDog wallet driver?
Post #Ay08Gdy45Tw5UWgS5g by [email protected]
0 likes, 0 repeats
@GossiTheDog is, is this like, can i like tell my bosses i need to go home and …
Post #Ay08PP1j0UVLl7ZXgO by [email protected]
0 likes, 0 repeats
@GossiTheDog @bjoreman you're the no dependency guy, right?
Post #Ay091K83fJUfZZcISG by [email protected]
0 likes, 0 repeats
@GossiTheDog Josh Junon posted on Bluesky. Fake 2FA reset e-mailhttps://bsky.ap…
Post #Ay09EfYvHvN7oNXve4 by [email protected]
0 likes, 0 repeats
@GossiTheDog looks like https://www.npmjs.com/~qixso lucky they didn't comp…
Post #Ay09NmXMj0q63AAA9w by [email protected]
0 likes, 0 repeats
@GossiTheDog is-arrayish, it has 9 lines of code ☠️
Post #Ay09lci6ubdUWUYc6a by [email protected]
0 likes, 0 repeats
@GossiTheDog wow, Pastebin just tried to give me malware while trying to view m…
Post #Ay09qLXy9YcSjt49Tc by [email protected]
0 likes, 1 repeats
@GossiTheDog Seems like they are fixing the problem by removing affected versio…
Post #Ay09z1uEXy6CQjcWsC by [email protected]
0 likes, 0 repeats
NPM on it, some packages nuked, more being nuked
Post #Ay0APyCkPtC2ll7taK by [email protected]
0 likes, 0 repeats
@GossiTheDog I was using some of those 😿
Post #Ay0AVBjXXmLSAzx92e by [email protected]
0 likes, 0 repeats
If you want an idea of scale of trojan attempt - 'color' alone had 32m …
Post #Ay0An3kZxpWwd4xcUS by [email protected]
0 likes, 1 repeats
@GossiTheDog is this a new attack vector? Typically, I've seen attackers us…
Post #Ay0B7jJH9jQrJe2uv2 by [email protected]
0 likes, 0 repeats
@GossiTheDog We could see that coming for a long time 😢. In a text I publish…
Post #Ay0BAHK7fHzTO1epAu by [email protected]
0 likes, 0 repeats
additional backdoored packagesansi-stylesdebugchalksupports-colorstrip-ansiansi…
Post #Ay0CS9SritNMB9pjJQ by [email protected]
0 likes, 0 repeats
@GossiTheDog now our #SBOMs will be tested.
Post #Ay0CobMyeZlf5zmgOO by [email protected]
0 likes, 1 repeats
Weekly download stats for impacted packages prior to incidentansi-styles (371.4…
Post #Ay0CrSFf0i5LgYiq3s by [email protected]
0 likes, 1 repeats
@GossiTheDog Whoever could have predicted that downloading 10GB of third party …
Post #Ay0CvRWBgB4IZLM1c8 by [email protected]
0 likes, 0 repeats
@GossiTheDog well if all they got was crypto.. nothing of value was lost..
Post #Ay0DI2jQ096MM5JsFE by [email protected]
0 likes, 0 repeats
Phishing email sent to maintainers, they basically targeted people with 2FA by …
Post #Ay0DTZLN5fhsgYZGWu by [email protected]
0 likes, 0 repeats
@GossiTheDog Ooh, please change your retina every three months...It's a pre…
Post #Ay0DVLJ2FlCLjAJxA0 by [email protected]
0 likes, 0 repeats
@GossiTheDog It's incredible that high profile targets like npm or GitHub S…
Post #Ay0ErpQb2bZfTS8xA8 by [email protected]
0 likes, 0 repeats
@yetzt @GossiTheDog or did they? https://github.com/debug-js/debug/issues/1005
Post #Ay0EthydiLjMwcxmKW by [email protected]
0 likes, 0 repeats
@GossiTheDog How do you drain a crypto wallet with JavaScript?
Post #Ay0EyogsBIsJDK5Z9E by [email protected]
0 likes, 0 repeats
@spzb @GossiTheDog oof
Post #Ay0F0D5IyDWBA0BIAa by [email protected]
0 likes, 1 repeats
@GossiTheDog That's a new one. (Too bad no alt text so no boost.)Maybe less…
Post #Ay0F2YGfBNlBRDbuVM by [email protected]
0 likes, 0 repeats
@GossiTheDog Holy hell, these are some widely used packages. I've found ton…
Post #Ay0F2y5ZBGKfWKcPom by [email protected]
0 likes, 0 repeats
@haagen @GossiTheDog Philosophically: absolutely 😊
Post #Ay0FCUuKWxVRucuHr6 by [email protected]
0 likes, 0 repeats
@tomw @GossiTheDog From now on I'm only going to use code I can type in fro…
Post #Ay0GEoxP3dZ2d113Jo by [email protected]
0 likes, 0 repeats
@GossiTheDog eli5: in what way are users affected and in what way the site and …
Post #Ay0GyBPIR6iXHph2CO by [email protected]
0 likes, 0 repeats
@GossiTheDog you mean to tell me that having dependencies on all of the librari…
Post #Ay0H98GwQoU4kY0Rwe by [email protected]
0 likes, 0 repeats
@GossiTheDog There's not a lot else to do in Skegness
Post #Ay0HDjRm9tUbCgGcts by [email protected]
0 likes, 0 repeats
@GossiTheDog There are bike sheds in Skegness?Painted what colour?
Post #Ay0HJKc3P8tZv2kEb2 by [email protected]
0 likes, 0 repeats
@GossiTheDog all you gotta do is find a few nerve points.
Post #Ay0HmpZTNgagKgbV0C by [email protected]
0 likes, 0 repeats
@GossiTheDog But, but, but... They said 2FA prevented phishing!When is 2FA not …
Post #Ay0I2aJHtB9zdPXruq by [email protected]
0 likes, 0 repeats
@GossiTheDogSee also the discussions on Git ML about adding Rust, where apparen…
Post #Ay0IR5fSxASpq4bWsK by [email protected]
0 likes, 0 repeats
@GossiTheDog ...phew, nothing dangerous then.(Yeah yeah, I know they could swap…
Post #Ay0J0cfIGKJIJUSzxY by [email protected]
0 likes, 0 repeats
@GossiTheDog That's Skegness near Pyongyang, right?
Post #Ay0K0kEYDpi3k1a24G by [email protected]
0 likes, 1 repeats
@GossiTheDog the trend in npm to use trivial libraries, i.e.ones you can replac…
Post #Ay0KIMoo1BYcKgwPBY by [email protected]
0 likes, 1 repeats
@GossiTheDog the typical “I want the benefit but I don’t want to deal with …
Post #Ay0M2bPKCzjYr3dJgm by [email protected]
0 likes, 0 repeats
@unlambda @GossiTheDog Uhg. Why would folks keep compromise commits in history.…
Post #Ay0M2dZg9TCjZkUc6a by [email protected]
0 likes, 0 repeats
@GossiTheDog Do you have a list of the compromised versions?A few of these, whe…
Post #Ay0M2dhpf9j5z2J7oW by [email protected]
0 likes, 0 repeats
@GossiTheDog Here's my best attempt at a list of the bad versions:- support…
Post #Ay0M2eE5jDWxb5Ot60 by [email protected]
0 likes, 0 repeats
@GossiTheDog Also, holy hell the left-pad nature of some of these deps. Here&#3…
Post #Ay0M3KnfRKwZdaMtNY by [email protected]
0 likes, 0 repeats
@leoluk @GossiTheDog Draconian systems that limit who can write and publish cod…
Post #Ay0M3wbasfrgt90mps by [email protected]
0 likes, 0 repeats
@GossiTheDog That's a clever phish.It looks similar to requests that compan…
Post #Ay0M9VJnFLcRzqKwUK by [email protected]
0 likes, 0 repeats
@GossiTheDog Good ol; Skeggy!
Post #Ay0MAFULaROTBtd1KC by [email protected]
0 likes, 0 repeats
@alienghic @GossiTheDog Yep, I blame all the incompetent enterprise policies fo…
Post #Ay0MDXdcZ01cLjXJ6O by [email protected]
0 likes, 0 repeats
@tautology @GossiTheDog With Deno it’s a lot easier to add fewer dependencies…
Post #Ay0MHcp3EKUpaRpVXk by [email protected]
0 likes, 0 repeats
@rabc @GossiTheDog Fuck micro-dependency shit.
Post #Ay0MMHl8yA5bi1Dy4m by [email protected]
0 likes, 0 repeats
@dalias @GossiTheDog Security Keys aren't draconian, they're easy to us…
Post #Ay0MMxRPztGaz0JoA4 by [email protected]
0 likes, 0 repeats
@mattb @GossiTheDog node is a platform for running javascript as a language on …
Post #Ay0MNRhPUzsspI20Fk by [email protected]
0 likes, 0 repeats
@Amgine @GossiTheDog It’s hard to tell after 57 years.
Post #Ay0NjKJTjy5IFBppWy by [email protected]
0 likes, 0 repeats
@GossiTheDogThe worst part is like half the libraries that get phished these da…
Post #Ay0OIPuCwKoLiwkNFI by [email protected]
0 likes, 0 repeats
@GossiTheDog I have never read a better description of vibe coding to date.
Post #Ay0OaC9YoFsgHgPCAi by [email protected]
0 likes, 1 repeats
@dalias @leoluk @GossiTheDog IBM has a vetted repository for z/OS, once again s…
Post #Ay0Oji17i3hRiMzmvw by [email protected]
0 likes, 0 repeats
@GossiTheDog @syklemil I would say z/OS runs the world economy m, HPE Nonstop h…
Post #Ay0PQy7Zi8SS72doLQ by [email protected]
0 likes, 1 repeats
@GossiTheDog This feels obvious, yet it seems that in light of the current even…
Post #Ay0QfTwGJKD6njplLM by [email protected]
0 likes, 0 repeats
@GossiTheDog Looks like there's a full list on the orange site: https://new…
Post #Ay0QihZq3n6ty6sg9w by [email protected]
0 likes, 0 repeats
@mattb @GossiTheDog Affected websites would largely run fine but if they were h…
Post #Ay0SPtMYDVjuvYp9vc by [email protected]
0 likes, 0 repeats
@GossiTheDog OK...so I just had a wallet drained. I'm still trying to figur…
Post #Ay0TCfSShdH9zaqZyi by [email protected]
0 likes, 0 repeats
@GossiTheDog it didn’t even occur to me how much more impactful some of the n…
Post #Ay0TImeyq5U64AcQbo by [email protected]
0 likes, 0 repeats
@GossiTheDog Also, all of that volunteer time isn't acknowledged by the com…
Post #Ay0UKzLSkMJRwT6YO8 by [email protected]
0 likes, 0 repeats
@GossiTheDog did they push to a new version or just updated current versions? (…
Post #Ay0UsuuxiLH63Yt6Bs by [email protected]
0 likes, 0 repeats
@GossiTheDog "kindly" 🚩
Post #Ay0Vul9h56piJQDkf2 by [email protected]
0 likes, 0 repeats
@GossiTheDog Yep...this attack is massive. If you use crypto, do not make any t…
Post #Ay0W5YvgsRjZa0p1qy by [email protected]
0 likes, 0 repeats
@GossiTheDog those early node and npm folks were trying their best, but if some…
Post #Ay0WSoPHV0cYF4kVXM by [email protected]
0 likes, 0 repeats
@GossiTheDog Obligatory: https://xkcd.com/2347/
Post #Ay0XiduIP9MOGVMuG0 by [email protected]
0 likes, 0 repeats
@GossiTheDog On a "side note": I always thought it was a great idea t…
Post #Ay0Xv6gXEaeizfsKcy by [email protected]
0 likes, 0 repeats
@GossiTheDog vibe-code honeypots?
Post #Ay0ZH7i4ClygUrebho by [email protected]
0 likes, 0 repeats
@GossiTheDog deep irony: go to that pastebin page on an ipad and it brings up a…
Post #Ay0ZX8NVUIYTCefi1Q by [email protected]
0 likes, 0 repeats
@GossiTheDog Wait, are you saying that they used a link in an email to go to re…
Post #Ay0ZezPoh8lliqUvjc by [email protected]
0 likes, 0 repeats
@GossiTheDog Skellige, not Skegness. Hope that helps!
Post #Ay0a3RUVxfJ9kQM5Wy by [email protected]
0 likes, 0 repeats
@GossiTheDog A list of vulnerable integrity hashes would be extremely useful - …
Post #Ay0aI9BaIo3nJoVqds by [email protected]
0 likes, 0 repeats
This npmjs phishing email led to npmjs.help. This site was a one-on-one copy of…
Post #Ay0anjZj3cmR9grm6q by [email protected]
0 likes, 0 repeats
@GossiTheDog CRC and GPG are a thing, right? How hard can it be to guarantee au…
Post #Ay0b9Zp7zhcjHYUC6C by [email protected]
0 likes, 0 repeats
@GossiTheDog Even I got that email and I haven't touched npm since about 20…
Post #Ay0f19LyvQIQgd5evA by [email protected]
0 likes, 0 repeats
@GossiTheDog Now if only there was a song about that : https://suno.com/song/9f…
Post #Ay0fMh5WhCxfOTfNku by [email protected]
0 likes, 0 repeats
@GossiTheDog strongly suspect that you are underestimating the actual number of…
Post #Ay0fOBRhJRMRpskO5Q by [email protected]
0 likes, 0 repeats
@GossiTheDog Know we know npm is hosted in Nebraska.https://xkcd.com/2347/
Post #Ay0fwiKdY6rFfyuTpI by [email protected]
0 likes, 1 repeats
@GossiTheDog Help a dumb security guy out? I haven't been a developer since…
Post #Ay0g7yFSiDSSE3rCfQ by [email protected]
0 likes, 0 repeats
@alienghic @GossiTheDog I’ve never seen a legitimate 2FA expiration, only pas…
Post #Ay0g7yNcDtyodLfiNM by [email protected]
0 likes, 0 repeats
@ShadSterling @GossiTheDog I haven't seen a 2 factor authentication rollove…
Post #Ay0g8WbywzfqnkefUO by [email protected]
0 likes, 0 repeats
@zarchasmpgmr @GossiTheDog @syklemil
Post #Ay0gBoVIsrXrA76DOy by [email protected]
0 likes, 0 repeats
@Amgine @GossiTheDog springgreen
Post #Ay0gLHYSF7qnrs5WJE by [email protected]
0 likes, 0 repeats
@stevel @GossiTheDog pastebin.com is nothing more than a malware distribution s…
Post #Ay0gaEWjmYHgozPjpg by [email protected]
0 likes, 0 repeats
@leoluk @GossiTheDog Mandating having a "something you have" is draco…
Post #Ay0gaEz656yAEwgO2K by [email protected]
0 likes, 0 repeats
@leoluk @GossiTheDog We should not be placing the burden of "users don&#39…
Post #Ay0gaFV0AUURptbrlY by [email protected]
0 likes, 1 repeats
@leoluk @GossiTheDog For the most part, none of these packages have any need fo…
Post #Ay0gaGBXcKW9xpVq4W by [email protected]
0 likes, 0 repeats
@dougwade @GossiTheDog When deep in a hole stop diggingNpm should be deprecated…
Post #Ay0glIA6bjn3HS6LnU by [email protected]
0 likes, 0 repeats
@GossiTheDog iirc, a typical CRA app started at about 1k packages.
Post #Ay0gq7DeihI4n33uLI by [email protected]
0 likes, 0 repeats
@dalias @leoluk @GossiTheDog at the very least, lets check GPG signatures rathe…
Post #Ay0gt6jGzxVO8gHGoC by [email protected]
0 likes, 0 repeats
@GossiTheDog "and an app is farted out" 😂
Post #Ay0hMrHP0ITguWQZ16 by [email protected]
0 likes, 0 repeats
@GossiTheDog Whoa!
Post #Ay0hc8i4TtV9JTBjYu by [email protected]
0 likes, 0 repeats
@GossiTheDog is-arrayish. WTF?
Post #Ay0iLLYPZcGgBDE69w by [email protected]
0 likes, 0 repeats
@GossiTheDog #doubleplusungood
Post #Ay0kN3SY1GdUY2QT68 by [email protected]
0 likes, 1 repeats
@Standard_Phil @GossiTheDog Every time npm fetches the source code counts as a …
Post #Ay0nin93ek7IBQMlua by [email protected]
0 likes, 0 repeats
@GossiTheDog we have done that looooong before agentic coding was a thing. And …
Post #Ay0rQCfmv4M5fg4F4i by [email protected]
0 likes, 1 repeats
@GossiTheDog ... the guy from Skegness:
Post #Ay1D0tXP7nCc4nU0em by [email protected]
0 likes, 0 repeats
@Standard_Phil an npm module gets downloaded if it doesn’t exist in the requi…
Post #Ay1D0tdmk4J4OaT6bQ by [email protected]
0 likes, 1 repeats
@_nd_ Thanks Andreas. Sounds like these are mainly developer activities then, n…
Post #Ay1b2cid1fevOO5eqm by [email protected]
0 likes, 0 repeats
@GossiTheDog shucks, I have the following libraries in #Convo 😳- color-conve…
Post #Ay1gZWoOVaaiOoISSu by [email protected]
0 likes, 0 repeats
@GossiTheDog This post is gold, I had such a good laugh.
Post #Ay1gyAYcO3smcMfR0y by [email protected]
0 likes, 0 repeats
@lanodan @leoluk @GossiTheDog @stevel This. The only real solution is not putti…
Post #Ay1gyAhTr6yJ3qoVpQ by [email protected]
0 likes, 0 repeats
@lanodan @leoluk @GossiTheDog @stevel Also let's not forget that no 2FA or …
Post #Ay1h53XervpYt2VCIi by [email protected]
0 likes, 0 repeats
@tautology @GossiTheDog Why do people do this?
Post #Ay1hO3bGsOfSZNFiTo by [email protected]
0 likes, 0 repeats
@dalias @lanodan @leoluk @GossiTheDog I'd add "not need to download ev…
Post #Ay1heZ8HPJv6zzZ1SS by [email protected]
0 likes, 0 repeats
@lanodan @leoluk @GossiTheDog @stevel @piggo Uncomfortable truth: LPMs are grow…
Post #Ay1hwPp4l9JpL05oiO by [email protected]
0 likes, 0 repeats
@etchedpixels @GossiTheDog @Amgine this sounds like a shibboleth and i live for…
Post #Ay1hxTDRd6Qw9OzhDs by [email protected]
0 likes, 0 repeats
@joby @leoluk @GossiTheDog Or even just copy&paste the 9 lines of code you …
Post #Ay1hzipAZKCX8eiHp2 by [email protected]
0 likes, 0 repeats
@lanodan @leoluk @GossiTheDog @dalias @stevel don't you see the actual prob…
Post #Ay1i95isnlOOlPEyBc by [email protected]
0 likes, 0 repeats
@emory The Law of Triviality - https://en.wikipedia.org/wiki/Law_of_triviality …
Post #Ay1i9IC2RBqPRIyQIS by [email protected]
0 likes, 0 repeats
@tautology @GossiTheDog I am not an npm user (or full time developer) but I fin…
Post #Ay1i9PnWAEz31ZYxBg by [email protected]
0 likes, 0 repeats
@sawaba @GossiTheDog npm install scripts are definitely the most common way. B…
Post #Ay1liC0vheskGz6wSm by [email protected]
0 likes, 0 repeats
@GossiTheDog I finally got around to writing about the entire mess (not just th…
Post #Ay1maSqJLmoQ6V1Tai by [email protected]
0 likes, 0 repeats
@dalias @leoluk That approach doesn't work. Suppose you're on version X…
Post #Ay2BRUS4UpznLGVDdo by [email protected]
0 likes, 0 repeats
@GossiTheDog I understand the concept, I’m just saying I can’t recall many …
Post #Ay2TBO10SS1lvAJW9g by [email protected]
0 likes, 0 repeats
@GossiTheDog the one guy in Skegness
Post #Ay2TTVmKKi99D85fKC by [email protected]
0 likes, 0 repeats
@GossiTheDog is-arrayish, I can't even
Post #Ay2UjTABvJv5ghQT0i by [email protected]
0 likes, 0 repeats
@GossiTheDog178 is either a crazy low estimate or you're only considering d…
Post #Ay2dB7gKBWLuny9YVU by [email protected]
0 likes, 0 repeats
@GossiTheDog in case anyone is interested in this sort of thing i've been h…
Post #Ay2fp4ue6Cfni021aK by [email protected]
0 likes, 0 repeats
@GossiTheDog Crazy work!
Post #Ay3wNzIakuZArFrOSm by [email protected]
0 likes, 0 repeats
@GossiTheDog Bless him, he’s a wonderful, extremely smart and very talented g…
Post #Ay7nczoczjkhqhlZGS by [email protected]
0 likes, 0 repeats
@dalias @GossiTheDog By "history" I meant package history, not Git hi…
Post #Ay8KTYJFBpI2QBBv6G by [email protected]
0 likes, 1 repeats
@GossiTheDog Is Skegness the sister city to Buttscratch, Wyoming?
Post #AyAuQZwCfFXFGjDPay by [email protected]
0 likes, 0 repeats
@GossiTheDog Links in email shouldn't be clickable without the user getting…
You are viewing proxied material from pleroma.anduin.net. The copyright of proxied material belongs to its original authors. Any comments or complaints in relation to proxied material should be directed to the original authors of the content concerned. Please see the disclaimer for more details.