Fake npm 2FA reset email led to compromise of popular code packages

📖 Read more: www.helpnetsecurity.com/2025/09/09/n...

#cybersecurity #cybersecuritynews #accounthijacking @aikidosecurity.bsky.social @ilkka.turunen.dev @gossithedog.cyberplace.social.ap.brid.gy

Our malware systems at Sonatype seem to be picking these up coming from other, not yet reported accounts. This attack seems to have landed more publishers as this unfolds. Check your accounts folks while we work with others to contain.

Yep, I've been pwned. 2FA reset email, looked very legitimate.

Only NPM affected. I've sent an email off to @npmjs.bsky.social to see if I can get access again.

Sorry everyone, I should have paid more attention. Not like me; have had a stressful week. Will work to get this cleaned up.

The web3.js compromise is a good example of legitimate library poisoning attacks. Sounds like a maintainer account was phished or an access token compromised. Basically any developer machine that installed this should be considered compromised github.com/solana-labs/...

These are going to be big changes in the way we all do our work

The Cyber Resilience Act (aka CRA, aka Regulation (EU) 2024/2847) has been published in the Official Journal of the European Union eur-lex.europa.eu/legal-conten...

Hi everyone.

The Onion, with the help of the Sandy Hook families, has purchased InfoWars.

We are planning on making it a very funny, very stupid website.

We have retained the services of some Onion and Clickhole Hall of Famers to pull this off.

I can't wait to show you what we have cooked up.

@axsharma.bsky.social wrote about it www.sonatype.com/blog/lottie-...

So, lottie-player, a popular js dep for playing videos was taken over through compromised dev tokens github.com/LottieFiles/...

I’m going to continue as i do on the other socials, posting what’s interesting to me. In this case that the SEC is going after companies that minimise cyber incidents, at least in the publicly traded realm. Not a huge hit to any one of them tho www.sec.gov/newsroom/pre...

As one of the authors of the report that is cited in the article - the vulnerability count is a yard stick of popularity of open source. Last year we reported that OSS projects are actually WAY better at applying & producing security patches vs closed source and industry

I do have to admit the air is so much cleaner here compared to the toxic smog over at Xitter. So nice to see actual tech twitter again

I haven't been this excited about social media since 2011.

There is a new 'Rapid Reset' Vulnerability described by Cloudflare this week that affects the HTTP2 protocol. This implementation of HTTP2 is pretty widespread in different OSS libraries and embedded servers. Great writeup here blog.sonatype.com/10-open-sour...

Huge news to share - we’re live with our 9th State of the Software Supply Chain report. 1 in 8 downloads contain some documented risk - and most of that could easily be avoided! Read the whole package here 👉 bit.ly/3LMRXo6

Hello world. Is this the federated social media to rule them all then?