GitHub fixes major security flaws in Node.js package manager npm that could have let attackers bypass authentication and publish versions of any package
an update on recent security incidents across the registry as well as a look into our ongoing investments in maintaining the security of the registry (including 2FA requirements) ⬇️ https://github.blog/...
“Vulnerability that would allow an attacker to publish new versions of any npm package using an account without proper authorization” Existed in the registry beyond the timeframe for which logs exist (Sept '20) No evidence of exploitation but damn that could have been SO bad... h…
I'm always kind of worried about how the 2FA requirements will interact with automation. Does NPM have a way to use service accounts to publish? Verified builds from transparent, secured build systems is the best long term approach here. https://twitter.com/...
“we received a report to our security bug bounty program of a vulnerability that would allow an attacker to publish new versions of any npm package” - oh :o https://twitter.com/...
https://github.blog/... “Second, on November 2 we received a report to our security bug bounty program of a vulnerability that would allow an attacker to publish new versions of any npm package using an account without proper authorization.” Thanks @ryanaraine for sharing
* NPM ‘replica’ service briefly leaked private scoped package names * A vulnerability could “allow an attacker to publish new versions of ANY npm package using an account without proper authorization.” * NPM to require 2FA from 2022 https://www.bleepingcomputer.com/ ... #opensour…