following ongoing investigations, we identified in real time multiple versions of the “rc” package containing identical malware to the “coa” package. malicious versions of “rc” were immediately removed from the registry and we have published an advisory:
this morning we detected multiple versions of the “coa” package published with malicious code due to a compromised account of a maintainer. we quickly removed the compromised versions and have published an advisory: github.com/advisories/GHS…. npm itself was not compromised. [1/3]- the compromised account has been temporarily disabled and we are actively investigating the incident and monitoring for similar activity. we will share additional information as appropriate based on our investigation. [2/3]
- to protect your accounts and packages from similar attacks, we highly recommend enabling 2FA on your npm account: docs.npmjs.com/configuring-tw…. [3/3]
- following ongoing investigations, we identified in real time multiple versions of the “rc” package containing identical malware to the “coa” package. malicious versions of “rc” were immediately removed from the registry and we have published an advisory:
folks you should at least give us a timeline of: * when they were published * how long they were available for without those data, how can we asses damage?
sooo how did this happen?
How about 8.1.0 version comes with node.js? Uninstall or what?
