98
Dozens of Red Hat packages backdoored through its official NPM channel (arstechnica.com)
submitted 5 months ago by to c/cybersecurity@sh.itjust.works
19 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 5 months ago (3 children)

I don't really see how it's NPM at fault here. This was caused by a malicious actor taking control of an account and putting out bad packages on it. It could happen on any package repository for any language

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 6 points 5 months ago (1 child)

    My understanding is that for most package managers the signing keys are held by a smallish number of maintainers responsible for entire sections, who presumably keep those accounts pretty tightly secured. Not impossible to take over, but it's a smaller attack surface.

    While for NPM as far as I know every uploader keeps their own account and there's not even signing keys to lose control of.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •