Malicious node-IPC Versions Published to NPM

6 points by varunsharma07 49 days ago | 2 comments

rvz 49 days ago |

Not again and it is NPM once more.

> Any project that installs one of these versions, directly or transitively, will pull the compromised release.

Hope you have pinned your dependencies in your package.json.

What a disaster.

freakynit 49 days ago |

Why why why it's npm, almost always?

rvz 49 days ago |

Not again and it is NPM once more.

> Any project that installs one of these versions, directly or transitively, will pull the compromised release.

Hope you have pinned your dependencies in your package.json.

What a disaster.

freakynit 49 days ago |

Why why why it's npm, almost always?