Hacker News Reader

The compromised code wasn't actually released. This write-up has a lot of information:

https://github.com/orgs/community/discussions/208477

A very pertinent comment from zod's maintainer, from that page:

> EDIT Sept 24 — All of my packages on npm have migrated to use environment-scoped staged publishing triggerable only by workflow_dispatch. This means 2FA is always required, so even if (god forbid) an npm or GitHub token is compromised, it will not be possible for the attacker to publish new versions.

So at least that's good to see. It would be nice for them to actually remove the commit from git history, though...

Close call, nevertheless, it's silly to keep that commit on the release page.

It's silly to not have rewritten it out of git history.

Yeah. A git bisect can still hit it.

It definitely doesn't inspire confidence in the project taking security seriously.

(Also the "write-up" is almost surely a "Claude-up", though it appears generated by someone external to the project).

He is (evidently) the product manager of NPM, so while external, I guess he should have a good idea of what's going on. Claude generated, yes, appears so, though it appears to be factually correct and fairly brief, from my quick perusal.

They still have the opportunity to remove it I guess?

Reply on news.ycombinator.com