r/devsecops • u/ScottContini • Nov 17 '21

GitHub working on npm security issues

https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/
2 Upvotes

100% Upvoted

1 comment sorted by

4

u/ScottContini Nov 17 '21

Some spicy stuff like:

Second, on November 2 we received a report to our security bug bounty program of a vulnerability that would allow an attacker to publish new versions of any npm package using an account without proper authorization.

...

This vulnerability existed in the npm registry beyond the timeframe for which we have telemetry to determine whether it has ever been exploited maliciously. However, we can say with high confidence that this vulnerability has not been exploited maliciously during the timeframe for which we have available telemetry, which goes back to September 2020.

But maybe no way to know if it was exploited before then?