1
NPM package compromised by author: erases files on RU / BY computers on install
Vue.js users using the dependency “node-ipc” are experiencing a supply chain attack protesting the invasion of Ukraine, from a package named “peacenotwar”.
Snyk Blog
Every AI-building team faces one question: can you trust what you're shipping? Snyk secures the code AI writes, the agents it runs, and the apps it builds. Get started for free or book a demo.
- Popular posts
- 14
- Total points
- 2,894
- HN comments
- 1,262
- Rank
- #411 company
Visit snyk.io → On Hacker News Jul 2016 – Nov 2024
Security & Privacy 12Software Engineering 6Web & Frontend 2Open Source 2Infrastructure & DevOps 2Systems & Performance 1
2
Open source maintainer pulls the plug on NPM packages colors and faker
Snyk issued a Denial of Service security vulnerability for colors@1.4.1, following this vulnerable code. We highly recommend you revert to colors@1.4.0, and pin your dependencies’ versions to avoid blind upgrades of the offending version. We also recommend you migrate to a different package.