@kitten The day I see an 'infosec' post about anything related to the JS ecosystem that actually gets the details right, is the day I will buy a cake and celebrate, and I don't think the bakery in question is getting my business any time soon
@kitten That's kind of the point, isn't it? They were skilled enough to get access and inject malware, and then too clueless to do anything interesting. That's like a burglar breaking into a well-secured home and then stealing spoiled food from the fridge instead of valuables. Good for the victims, but really weird.
@kitten True, it was an attack on npm (or rather a package maintainer). But Node.js deployment usually use packages from npm, don't they? So they could've been affected if the attacker hadn't limited themselves for whatever odd reason.
