Now Pushing Malware: NPM package dev logins slurped by hacked tool popular with coders

King Canute

This is yet another example of the scumbags winning the battle. Everything has an entry point and sooner or later they’ll exploit it. I can’t see highly secure, let alone fully secure software happening in many years even decades. Way too much sloppiness or human errors to stop it. Until there are laws and large fines and assurance certification for purveyors of software it will just get worse.

why the F

And this is why using shitty cloud repositories for javascript libs is fucking stupid, just because your too fucking lazy to load it on your own site.

Sites now need to fetch from 100's of bloody sites due to this type of shit..

at least it gives me a way of easily making a block list of sites not to visit

Habits

Um, when your product and repo shows up in the news as a hacker victim more than once a year, maybe it's time to check the habits of your community.

As a gatekeeper, I'm supposed to decide which repos our devs have access to and which don't--and this one is beginning to worry me. And, having tinkered with this one myself, I don't want to have to shut it out completely, but... Oh, this is seriously giving me the willies.

Scratching my head...

... as to why code signing isn't employed here. It is that that is designed to stop exactly this.

Time to force two-factor authentication?

"To mitigate this risk, we encourage every npmjs.com user to enable two-factor authentication, with which this morning’s incident would have been impossible."

Surely it is time npm forced two-factor authentication rather than just encouraging it?

mini-wince

No biggy, but....

... possibly initiating a chain reaction of cyber-crime.

I know what the intended meaning was - I think - but the phrase doesn't communicate it very well. Yeah I know, everyone's a critic,.. I'm just picturing a tabloid hack looking for stories to lift (or background) seeing the expression and getting altogether the wrong idea.