Mac to [email protected] • 11 months agoSSH keys stolen by stream of malicious PyPI and npm packageswww.bleepingcomputer.comexternal-linkmessage-square10fedilinkarrow-up1122arrow-down12cross-posted to: [email protected][email protected]
arrow-up1120arrow-down1external-linkSSH keys stolen by stream of malicious PyPI and npm packageswww.bleepingcomputer.comMac to [email protected] • 11 months agomessage-square10fedilinkcross-posted to: [email protected][email protected]
minus-square@platypus_plumbalink1•11 months agoIt’s honestly crazy that tools like npm don’t force you to encrypt the tokens for the npm repos. They don’t even support it. Any stupid read_file() with http.post() can screw 1000 people.
And this is why you password protect your ssh keys
It’s honestly crazy that tools like npm don’t force you to encrypt the tokens for the npm repos. They don’t even support it. Any stupid read_file() with http.post() can screw 1000 people.