No new npm packages compromised?

[mccovican@infosec.exchange]

@cR0w Shenanigans ahoy! https://www.bleepingcomputer.com/news/security/popular-node-ipc-npm-package-compromised-to-steal-credentials/

[cr0w@infosec.exchange]

@McCovican I think that one was published yesterday, which is like three years ago in this week time.

[mccovican@infosec.exchange]

@cR0w BleepingComputer are getting slow in their old age (likewise).

[starchturrets@mastodon.social]

@ciaranmak @cR0w I'm not so sure how bad this is in comparison to the embargoed KVM one at https://xchglabs.com/blog/

[ciaranmak@mastodon.ie]

@starchturrets @cR0w I will report back because tbh if I don't end up out in the pub this evening I'm probably gonna test this one out

[viss@mastodon.social]

@ciaranmak @starchturrets @cR0w oh god yes. docker 0day. shoot that shit right into my veins

[starchturrets@mastodon.social]

@Viss @ciaranmak @cR0w well runc isn't really a very strong boundary compared to gvisor or kata containers, so I'm not too worried there

[rikusilvola@infosec.exchange]

@cR0w here you go https://www.openwall.com/lists/oss-security/2026/05/15/2

[nuclearoatmeal@beige.party]

@cR0w

Day ain't over yet.

[huronbikes@cyberplace.social]

@cR0w maybe all the fire is hiding some fire we don't know about

[cr0w@infosec.exchange]

@huronbikes You mean fire can grow?!

[badsamurai@infosec.exchange]

@NuclearOatmeal @cR0w

[nyanbinary@infosec.exchange]

@cR0w darf asked nicely

[jackryder@infosec.exchange]

@cR0w Gearing up for Monday morning...

[huronbikes@cyberplace.social]

@cR0w I heard a rumor that it can but it's hard to confirm what with being on fire and all.

[cr0w@infosec.exchange]

@nyanbinary That doesn't sound like @darfplatypus ...

[darfplatypus@infosec.exchange]

@cR0w @nyanbinary pending analysis. Sorry y'all.

[da_667@infosec.exchange]

@badsamurai @NuclearOatmeal @cR0w zero days. zero days, erryday

[viss@mastodon.social]

@cR0w docker 0days coming, stuff embargoed atm. more npm tooooo https://xchglabs.com/blog/

[cr0w@infosec.exchange]

@Viss I saw that but no timeline and no descriptions. Could be total bummers like a lot of the "coming soon" stuff from ZDI and Talos. Fingers crossed though.