Friendly takeover of foreach package on NPM

https://mastodon.social/@lrvick/108274265429826806

by archi42 • 4 years ago

8 2 4 years ago

archi42• 4 years ago

Another npm package taken over. Could not verify it, but the person claims that in total 36826 projects depend on it (npm lists 144 direct dependents). Also the "friendly" is editorialized by me to reflect the authors claims.

Package on npm: https://www.npmjs.com/package/foreach

Since I editorialized the title (title = mastodon message content, which is too long; also it starts with "I just noticed...", which would be misleading), @dang feel free to edit, or @HN feel free to suggest a better title.

dane-pgp• 4 years ago

That seems like a reasonable title, thank you.

In fact, this issue was reported more generally at least a couple of months ago, with 2,818 accounts potentially affected[0]. The intended solution for this is to require 2FA for developers, which NPM are slowly rolling out.

[0] https://therecord.media/thousands-of-npm-accounts-use-email-...

Friendly takeover of foreach package on NPM

Related Stories