Can we all stop using npm at this point?
this post was submitted on 02 Jun 2026
100 points (99.0% liked)
Linux
65597 readers
228 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
Sure but npm is a target due to reach. Its happened with Python too.
So, lets all switch to Rust and use cargo.. Oh, fuuu, wait, how about maven, they too? .... It's in the nature of the thing. Assess your dependencies and get your SBOM monitored.
Oh, cool! Red Hat! The people who run a company charging for support. This makes me feel very safe.
Ever since the ssh thing, but especially in the last few months, I really don't feel safe with anything on the internet.
Dare I ask, what ssh thing?
Side Note: It was already believed that SSH encryption was broken by state actors since the first NSA leaks. So, people should at least always use it over another encrypted channel anyway.
"would you still love me if I was a credential thief?"
I can't decide if this is real or an advertisement for the linked article service. I don't see any CVE in the article which seems to be a good indication of the quality of the content.
I'm not saying that this is misinformation, but I'm extremely sceptical about the nature of this article.
This definitely has the feel of an ad.
I did see it also here - https://thecybersecguru.com/news/red-hat-npm-packages-compromised-miasma-worm/
It can be both
Like Inception.
The article service that talks about a compromise to steal credentials that secretly steals your credentials.
Not a computer guy; did not know there was such a thing as a npm package. From the article, it looks like this is a GitHub based problem. No?
Redhat employee had leaked credentials, threat actor used those credentials to push some files to GitHub, which executed the code in a GitHub action which had trusted access to publish to NPM.
Essentially, an employee got owned and someone used their access (that they already had) to publish the nefarious code.
You'll see GitHub Actions in these often, as that's how a lot of big open source organizations publish their packages and run tests/deployments. It's less of a "GitHub based problem" and more of a "trust boundary problem", if they used other services, the same problem could likely have still been successful.
Thx for the explanation.
It's a compromise between Red Hat and the Hacker.
Not so much of a problem then