HNNewShowAskJobs
Built with Tanstack Start
Prettier NPM Packages Compromised in Supply Chain Attack(socket.dev)
44 points by feross 2 days ago | 5 comments
  • c-hendricks2 days ago

    eslint-config-prettier and eslint-plugin-prettier, not prettier proper.

    https://news.ycombinator.com/item?id=44609732

  • acheong082 days ago

    Anyone done reverse engineering on what the dll does? The advice of rolling back versions wouldn't be sufficient if it also exfiltrated ssh keys and such for pushing to git

    • warmedcookie2 days ago |parent

      I was infected and it disables chrome security flags (you'll see a banner in Chrome indicating this) and probably a bunch of other nasty things. I unplugged my Ethernet, turned off the computer, bought a new SSD and installed fresh copy of windows on it. Deleted the boot files / renamed windows folder on infected SSD and slowly pull files over that I need.

      I also deleted all SSH keys / changed passwords. Lessons learned? Disable scripts and run in a container.

      Bright side? I now have a 4TB SSD instead of a 2TB SSD.

  • tiagod2 days ago

    This is pretty bad.

  • gausswho2 days ago

    Only vulnerable on Windows machines?