Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Was npmjs.org temporarily compromised? (github.com/isaacs)
3 points by dbeardsl on April 23, 2014 | hide | past | favorite | 1 comment


tldr;

During an npm install of the tar module I received this:

    npm http 200 https://registry.npmjs.org/tar
    npm ERR! registry error parsing json
    npm ERR! SyntaxError: Unexpected token y
    npm ERR! ny-leone-porn-sex-scene/Sunny-Leones-deleted-sex-scene-from-Ragini-MMS-2/photostory/33010796.cms"})^@9"},"�������

Followed by the rest of the package.json from the module.

Something or someone injected data into the response I got from npmjs.org. The fact that it was Isaac Schlueter's account is particularly worrisome.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: