The list of packages looks like these are not just tiny solo-person dependencies-of-dependencies. I see AsyncAPI and Zapier there. Am I right that this seems quite a significant event?

AsyncAPI is used as the example in the post. It says the Github repo was not affected, but NPM was.

What I don't understand from the article is how this happened. Were the credentials for each project leaked? Given the wide range of packages, was it a hack on npm? Or...?

▲

merelysounds 7 hours ago | parent | next [-]

There is an explanation in the article:

> it modifies package.json based on the current environment's npm configuration, injects [malicious] setup_bun.js and bun_environment.js, repacks the component, and executes npm publish using stolen tokens, thereby achieving worm-like propagation.

This is the second time an attack like this happens, others may be familiar with this context already and share fewer details and explanations than usual.

Previous discussions: https://news.ycombinator.com/item?id=45260741

▲

tasuki 3 hours ago | parent | next [-]

I don't get this explanation. How does it force you to run the infection code?

Yes, if you depend on an infected package, sure. But then I'd expect not just a list, but a graph outlining which package infected which other package. Overall I don't understand this at all.

	▲	merelysounds 3 hours ago \| parent [-]
		Look at the diff in the article, it shows the “inject” part: the malicious file is added to the “preinstall” attribute in the package.json.

▲

vintagedave 7 hours ago | parent | prev [-]

Thanks. I saw that sentence but somehow didn't parse it. Need a coffee :/

▲

throw-the-towel 7 hours ago | parent | prev [-]

My understanding is, it's a worm that injects itself into the current package and publishes infected code to npm.