가을별 @gaeulbyul@planet.moe
Public

아래 npm 패키지에서 악성코드가 발견되었다고 하네요. 최근에 있었던 npm을 사칭한 피싱 메일로 인해 보안토큰을 탈취당하신 듯...

eslint-config-prettier: 8.10.1, 9.1.1, 10.1.6, 10.1.7
eslint-plugin-prettier: 4.2.2, 4.2.3
synckit: 0.11.9
@ pkgr/core: 0.2.8
napi-postinstall: 0.3.1

Active Supply Chain Attack: npm Phishing Campaign Leads to Prettier Tooling Packages Compromise - socket.dev/blog/npm-phishing-c

Active Supply Chain Attack: npm Phishing Campaign Leads to P...

Popular npm packages like eslint-config-prettier were compromised after a phishing attack stole a maintainer’s token, spreading malicious updates.

socket.dev · Socket

6
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://planet.moe/users/gaeulbyul/statuses/114894705931471785 on your instance and quote it. (Note that quoting is not supported in Mastodon.)