ChALkeR/notes
View on GitHub ↗ ★ 1,275
Some public notes
21 mentions on Hacker News by 17 people: 15 stories, 6 comments · first 2015-12-04 · latest 2022-05-05
20082026
-
…less of a reputation and might be malicious, as was the case with the event-stream package.[1] [0] https://github.com/ChALkeR/notes/blob/master/Gathering-weak-... [1] https://www.eweek.com/security/node.js-event-stream-hack-exp...
comment by dane-pgp · 2022-05-05 · in GitHub will require 2FA by the end of 2023 -
…but a hello world app requires 203 modules and that's not really a safe position to start new apps. https://github.com/ChALkeR/notes/blob/master/Do-not-underest...
comment by benologist · 2017-11-04 · in Show HN: Server.js – A modern Express alternative -
▲ 4
Improper markup sanitization in popular softwarestory by monort · 2017-07-18 · 0 comments
-
And then this happens: https://github.com/ChALkeR/notes/blob/master/Improper-markup...
comment by joepie91_ · 2017-07-18 · in Myspace lets you hijack any account just by knowing the person’s birthday -
▲ 3
Gathering weak npm credentialsstory by gburt · 2017-06-26 · 0 comments
-
▲ 55
How I obtained direct publish access to 13% of npm packagesstory by kasbah · 2017-06-26 · 0 comments
-
▲ 14
Obtaining publish access to 13% of npm packagesstory by Artemis2 · 2017-06-24 · 2 comments
-
▲ 12
Gathering weak npm credentialsstory by philfreo · 2017-06-23 · 0 comments
-
▲ 4
Gathering weak npm credentialsstory by JBiserkov · 2017-06-23 · 0 comments
-
▲ 5
Gathering weak npm credentialsstory by steve_taylor · 2017-06-23 · 1 comment
-
▲ 5
How I obtained publish access to 13% of npm packages (including popular ones)story by ChALkeR · 2017-06-22 · 0 comments
-
▲ 10
Gathering weak npm credentialsstory by petethomas · 2017-06-22 · 0 comments
-
▲ 20
Gathering weak npm credentialsstory by feross · 2017-06-22 · 1 comment
-
…credentials leaks have been littered across the community and they've been aware since 2015. See https://github.com/ChALkeR/notes/blob/master/Do-not-underest... for more information.
comment by micaksica · 2017-06-07 · in The Great Suspender developer account hacked, extension pulled from Chrome Store -
…https://docs.npmjs.com/misc/scripts [2] https://github.com/node-forward/discussions/issues/29 [3] https://github.com/ChALkeR/notes/blob/master/Do-not-underest... [4] https://www.npmjs.com/package/isarray EDIT: Ironically, this module…
comment by micaksica · 2016-08-08 · in Show HN: Auto install npm dependencies as you code -
▲ 2
Stealing Travis secure variables (and Snap CI too)story by ChALkeR · 2016-07-07 · 0 comments
-
▲ 2
Let's Fix Node.js Buffer APIstory by ChALkeR · 2016-01-15 · 1 comment
-
▲ 5
Node.js Buffer knows everything – your traffic, sources, keys and configsstory by ChALkeR · 2016-01-14 · 5 comments
-
▲ 355
Survey of popular Node.js packages reveals credential leaksstory by fapjacks · 2015-12-06 · 76 comments
-
▲ 3
Do not underestimate credential leaksstory by jergason · 2015-12-04 · 0 comments