Skip to content

Instantly share code, notes, and snippets.

@hdgarrood

hdgarrood/malicious-code-purescript-npm-installer.md

Last active August 8, 2019 12:51
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save hdgarrood/5735886b7704389de5ef379413c00d78 to your computer and use it in GitHub Desktop.
Save hdgarrood/5735886b7704389de5ef379413c00d78 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
malicious-code-purescript-npm-installer.md
@hdgarrood
Copy link
Author

hdgarrood commented Jul 12, 2019 •
edited

So just to be clear, are you saying that you didn’t have 2FA for npm set up until just now, despite the fact that you reminded us that we should enable it a few weeks ago, on the issue in the node-purescript repo where I suggested transferring the npm package?

@hdgarrood
Copy link
Author

I see. Also, did npm not email you when load-from-cwd-or-npm@3.0.2 and rate-map@1.0.3 were published?

@hdgarrood
Copy link
Author

Ok. thanks. I also noticed that load-from-cwd-or-npm@3.0.2 is accompanied by a commit in GitHub which seems to indicate that it was published by someone with access to your github SSH key: shinnn/load-from-cwd-or-npm@5be252c. Was that commit made by you or was your github SSH key compromised as well?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment