eslint-config-prettier npm package compromised | Hacker News Reader

eslint-config-prettier npm package compromised

stepsecurity.io

74 pointsvarunsharma0711 comments

One thing Npm should implement (at least for popular packages) is deny publishing new versions that don't have provenance [1] if the previous versions had it. This would have stopped this attack.

[1] https://docs.npmjs.com/generating-provenance-statements

It appears the individual was unable to distinguish a display name from the actual email address (common phishing tactic of having something like admin@company.org as the email display name while the actual email address is a random throwaway). [1]

Good reminder to use a password manager as well (as it would also catch the 'npnjs' typo squatted domain too).

Similar incident happened to the HIBP guy who mentioned ignoring the password manager safeguards due to being half asleep while on the plane.

Also keep in mind you can disable install scripts in npm from running (if you happen to not do your development in an isolated environment) via configuring your .npmrc with

> ignore-scripts=true

Stay safe out there

1: https://x.com/JounQin/status/1946297662069993690

>the individual was unable to distinguish a display name from the actual email address

This is wild to me, not just because they're a developer but they even know about SPF/DMARC. Also, the content of the email being them asking to reverify your email sounds suspicious and illogical. I know people make mistakes, but it's just crazy, and shows the importance of companies training employees to not fall for phishing emails.

Dunno, this is also a failure of email client UI which is designed around a naive world with no bad actors just so it looks cute.

The sender email address could be more prominent.

All link URLs could be visible.

Emails from new senders could have some sort of warning/alert. I used to use an email client that let you approve incoming email addresses, and it once saved me from a Coinbase phishing email since it made me double check the sender since it was marked as unapproved.

We can't keep blaming the victim when our own software works in the favor of bad actors. You're going to let your guard down one day.

This will break many things that rely on installation scripts to work properly.

Use a better package manager that always disables installation scripts and lets you whitelist only those you absolutely need (like pnpm — which asks you post-install if any scripts were necessary, and reruns those you confirm).

Also avoid horrible tire fires like eslint that require several hundreds of unvetted dependencies. If you work alone and are disciplined, it's perfectly possible to write good TS without a linter. If not — use biomejs.dev (zero external dependencies) or `deno lint`.

Also node can easily be isolated from the rest of the system through bubblewrap/firejail:

  $ ls -a ~
  .  ..  code

https://wiki.archlinux.org/title/Bubblewrap

https://wiki.archlinux.org/title/Firejail

Biome has a 5000+ line cargo.lock file. That’s a lot of dependencies. You just don’t see them directly in npm. This is the reason I dislike Rust and prefer Go. Rust is the JavaScript packaging culture applied to systems programming.

I feel like this is a really big deal, eslint and prettier are a must-have for any js/ts project, imo. Many developers could be affected (and probably were). Which will lead to even more supply chain attacks down the line...

This package is downloaded millions of times a week https://www.npmjs.com/package/eslint-config-prettier?activeT...

It's the primary way suggested to integrate the two https://prettier.io/docs/integrating-with-linters

Hit me. Disables security in Chrome. I will be wiping everything. Changed passwords already, but I assume they stole everything.

why isn't this bigger news?

it looks like installing a dll so maybe it's windows only?

https://github.com/prettier/eslint-config-prettier/issues/33...

Reply on news.ycombinator.com