Patrick Nelson

Full stack developer @eBay and all around website guy. Follow me on and

[Patrick Nelson @ptrcknlsn]

@JohnONolan @Ghost As one who has integrated several of those bloated nonsense systems over the years… I can very much confirm this statement!

They’re also monolithic; any change you need to make is usually met with “That’s core functionality” and it’s too hard to change. Difficult nut to crack.

[Patrick Nelson @ptrcknlsn]

@wesbos Ḫ̴̤̯̂̃̚e̴̪̓̈́ ̶̢̻̼̕l̸̙͔̦̅̂͒̚i̶̘̻͐͘v̶̹̔̆̅ë̸̢̝̳̖́͆s̷̡̘̓

[Patrick Nelson @ptrcknlsn]

@wesbos Codex mentioned.

[Patrick Nelson @ptrcknlsn]

@Drevopolis @DraleZero @wesbos lol, wow yeah… I do vaguely remember that. Was definitely talked about a lot. Interesting how priorities shift as you grow up. If only I still had unlimited time to dedicate to trivial crap like that. Awesome learning experience & opportunity to experiment w/ critical thinking

[Patrick Nelson @ptrcknlsn]

@jasonsaayman @kristovatlas I wonder if NPM notified you that your email account had been changed as well. Please include that detail as well as if the attacker was able to also phish your password (in case any of the changes they made required that confirmation step once they obtained your session cookies)

[Patrick Nelson @ptrcknlsn]

@jasonsaayman @kristovatlas For anyone watching, he commented here: https://t.co/LwtZdGQ4Mm

[Patrick Nelson @ptrcknlsn]

@jasonsaayman @kristovatlas I’ll follow with notifications. Just tweet it once it’s out and I’ll be interested to read the post mortem. Thanks Jason for the transparency!

[Patrick Nelson @ptrcknlsn]

@jasonsaayman @mehtadata_ @wesbos The author himself. I can’t believe you showed up in the replies here only hours after and got no love.

BTW: Was this a granular token compromise? If you delete that and move your workflow over to pure OIDC (trusted publisher, not just provenance) it should definitely help. 😊

[Patrick Nelson @ptrcknlsn]

@vayospot @wesbos

[Patrick Nelson @ptrcknlsn]

@Yonar87 @wesbos @jfrog Nice. How quickly was this flagged in your system? I believe this exploit was live for ~3 hours before it was caught and taken down.

[Patrick Nelson @ptrcknlsn]

@simonxabris @wesbos At least with npm, I believe “npm i” and “npm ci” both respect the contents of the package-lockfile.json. The only major difference I’m aware of is that “npm i” will update the lockfile only if the package.json has also drifted. Otherwise, I *think* you’re fine.

[Patrick Nelson @ptrcknlsn]

@TomWatkins1994 @wesbos Defense in depth; it’s this *and* lots of other options layered on top. Less deps, lock those deps down with lockfiles, set a minimum age, don’t run scripts, use SCA (software composition analysis, i.e. dependabot), etc and so on. 😊

[Patrick Nelson @ptrcknlsn]

@EIsenah @tristanbob @wesbos Yeah it’s weird that you can do --min-release-age=n and min-release-age=n in .npmrc but there’s no global setting. TBF, it is new (circa npm 11).

[Patrick Nelson @ptrcknlsn]

@tristanbob @wesbos On the flip slide, as a maintainer, *never* use long-lived creds that bypass 2FA. In CI/CD, you can publish with OIDC (configure in npm with “trusted publishers”). Otherwise, publish manually and just plug in your 2FA each time.

[Patrick Nelson @ptrcknlsn]

@tristanbob @wesbos Also, in this case, disabling install scripts (i.e. --ignore-scripts, or ignore-scripts=true in .npmrc). The main payload was delivered via a transitive dependency that had a post install script that downloaded a RAT.

[Patrick Nelson @ptrcknlsn]

@amereid92 @wesbos They mined your prompts to build their matchesNegativeKeyword() function.

[Patrick Nelson @ptrcknlsn]

@wesbos Yeah. Wow, that’s a shitty thing to do. 🤦‍♂️

[Patrick Nelson @ptrcknlsn]

@SnazzyLabs Peak marketing! Get it, Quinn. 😂

[Patrick Nelson @ptrcknlsn]

@openid Do you guys have a version of this video with sound? https://t.co/GzY07AIIag

It's on the site and seems like a useful high level technical explainer straight from the source, but it's missing a critical element: Audio! 😅

[Patrick Nelson @ptrcknlsn]

@usrbinsean @wesbos I remember that (and I built loads of ecomm sites prior to 2014). Thanks to widespread adoption of SNI (maybe after 2011? 2012?) we could finally start serving different certs for IPs. And then SANs which I think came later (pack more domains into a single cert).