Koa: Security Issue. Status?

[juancancela]

Hi,
I have just read this article: https://www.bleepingcomputer.com/news/security/52-percent-of-all-javascript-npm-packages-could-have-been-hacked-via-weak-credentials/
and since koa is directly referenced, I just wanted to know if theres an status / update on this.

Thanks!

[nathan-k]

One of the passwords with access to publish koa was literally 'password'

How can you trust a status update after this?

[jonathanong]

luckily, i know that one wasn't me 😹

we can just do a user audit and kick out people without 2 factor in the github org and remote npm publishing rights from people who haven't been publishing

[fl0w]

@nathan-k to be fair, now is probably when you should be "least" concerned - right after an exposé like this. A lifejacket should be worn even in calm waters - when it's stormy, everyones knows to wear it. Weird analogy

So Koa was directly targeted in that article - they say there's no bad press, but .. well :rofl:

[fengmk2]

Everyone should enable 2 factor.

[dead-horse]

we can just do a user audit and kick out people without 2 factor in the github org and remote npm publishing rights from people who haven't been publishing

😓 Let's do this.

[jonathanong]

emailed/tweeted people who don't have 2 factor auth in this org.

[jonathanong]

still a few people left.

for npm permission... not sure, that's a lot more work. lol. ideally, npm has 2 factor auth

[jonathanong]

i will need to spend time later to boot people off npm packages

[niftylettuce]

@jonathanong we should prob just do this immediately, we can always add people back after they take this seriously

[jonathanong]

removed people. let me know if you see anyone a collaborator of a koa project that shouldn't be or hasn't been active in a while