| ▲ | greatestdevever 2 days ago | |
Hey, new dev here. Sorry if this is a common knowledge and I am asking a stupid question. How does you getting phished affect these NPM packages? aren't these handled by NPM or the developers of them? | ||
| ▲ | p91paul 2 days ago | parent | next [-] | |
The guy is actually the maintainer of those packages. So whoever got his credentials became able to perform releases on those packages. NPM itself does not build any package, it's just a place where people can publish stuff | ||
| ▲ | handstitched 2 days ago | parent | prev [-] | |
OP is the developer & maintainer of the affected packages, so the attacker was able to use their phished credentials to upload compromised versions to NPM. | ||