pull down to refresh
How the heck does an experienced open source maintainer fall for a phishing attack?
It must have been a very sophisticated and convincing phishing attempt?!
reply
pull down to refresh
How the heck does an experienced open source maintainer fall for a phishing attack?
It must have been a very sophisticated and convincing phishing attempt?!
from Claude...
Based on the research I've gathered, here are the 18 specific NPM packages that were compromised in this supply chain attack:
The Compromised Packages (with weekly download numbers):The Compromised Packages (with weekly download numbers):
Starting at September 8th, 13:16 UTC, these 18 very popular packages were compromised:
Highest Impact Packages:
Medium Impact Packages:
Lower Impact Packages:
What These Packages DoWhat These Packages Do
These are all fundamental utility packages that handle basic functions like:
The ScaleThe Scale
These utilities underpin much of the modern web and collectively account for more than 2.6 billion weekly downloads. They're the kind of packages that get included in almost every JavaScript project without developers even realizing it.
How the Attack HappenedHow the Attack Happened
Hackers compromised the npm account of Josh Goldberg, a well-known open-source maintainer known as "Qix," through a phishing campaign that targeted npm maintainers with emails impersonating the platform's support team.
These aren't flashy frameworks - they're the invisible building blocks that millions of websites and applications depend on, which is exactly what made this attack so devastating.