Hacker News: DDerTyp

PHP's CVSS 9.2 fixes: Memory exhaustion and stale request state

DDerTyp — Wed, 21 Oct 2026 14:24:26 +0000

Article URL: https://jdstaerk.substack.com/p/php-emergency-fix

Comments URL: https://news.ycombinator.com/item?id=50181552

Points: 1

# Comments: 0

Fake GitHub Repositories Spreading Malware via PowerShell

DDerTyp — Mon, 14 Sep 2026 12:56:21 +0000

Article URL: https://jdstaerk.substack.com/p/greetings-from-the-rabbids-team

Comments URL: https://news.ycombinator.com/item?id=49696063

Points: 1

# Comments: 1

Node.js Security Fix Silently Broke node-fetch, which broke other tools

DDerTyp — Fri, 19 Jun 2026 10:49:25 +0000

Article URL: https://jdstaerk.substack.com/p/nodejs-security-fix-silently-broke

Comments URL: https://news.ycombinator.com/item?id=48597105

Points: 4

# Comments: 1

Node-Fetch on latest Node Update broken

DDerTyp — Fri, 19 Jun 2026 09:58:42 +0000

Article URL: https://github.com/nodejs/node/issues/63989

Comments URL: https://news.ycombinator.com/item?id=48596801

Points: 4

# Comments: 0

Ask HN: What would you like to be working on?

DDerTyp — Mon, 11 May 2026 12:45:59 +0000

Contrary to "What are you working on?", what would you like to be working on?

Comments URL: https://news.ycombinator.com/item?id=48094258

Points: 8

# Comments: 11

New comment by DDerTyp in "Don't become an engineering manager"

DDerTyp — Tue, 03 Mar 2026 21:11:08 +0000

Can you elaborate more about this? Why is it irrelevant in Western Europe?

Nobel Peace Prize 2025: Venezuelan Politician Maria Corina Machado

DDerTyp — Fri, 10 Oct 2025 09:04:15 +0000

Article URL: https://www.bbc.com/news/live/c1l80g1qe4gt

Comments URL: https://news.ycombinator.com/item?id=45536708

Points: 18

# Comments: 11

New comment by DDerTyp in "I tracked Amazon's Prime Day prices. We've been played"

DDerTyp — Fri, 10 Oct 2025 08:38:11 +0000

Obvious comment to various Amazon price trackers like https://keepa.com/

30–60–90-day guide to leading your new dev team like a pro

DDerTyp — Wed, 08 Oct 2025 13:30:54 +0000

Article URL: https://www.kamenistak.com/guide-to-leading-your-new-dev-team/

Comments URL: https://news.ycombinator.com/item?id=45515971

Points: 1

# Comments: 0

GitHub: Our plan for a more secure NPM supply chain

DDerTyp — Thu, 25 Sep 2025 10:32:23 +0000

Article URL: https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/

Comments URL: https://news.ycombinator.com/item?id=45371264

Points: 2

# Comments: 0

The September NPM Attack Was a Warning. Are We Listening?

DDerTyp — Tue, 23 Sep 2025 15:13:55 +0000

Article URL: https://jdstaerk.substack.com/p/vulnerabilities-in-the-npm-ecosystem

Comments URL: https://news.ycombinator.com/item?id=45348239

Points: 2

# Comments: 0

New comment by DDerTyp in "NPM debug and chalk packages compromised"

DDerTyp — Mon, 08 Sep 2025 18:55:01 +0000

TIL: I need to fix my CI pipeline. Gonna create a jira ticket I guess…

Thank you!

New comment by DDerTyp in "NPM debug and chalk packages compromised"

DDerTyp — Mon, 08 Sep 2025 18:49:05 +0000

You’re right and the excerpt you quoted was poorly worded and confusing. A lockfile is designed to do exactly what you said.

The package.json locked the file to ^1.3.2. If a newer version exists online that still satisfies the range in package.json (like 1.3.3 for ^1.3.2), npm install will often fetch that newer version and update your package-lock.json file automatically.

That’s how I understand it / that’s my current knowledge. Maybe there is someone here who can confirm/deny that. That would be great!

New comment by DDerTyp in "NPM debug and chalk packages compromised"

DDerTyp — Mon, 08 Sep 2025 16:18:08 +0000

Noticed that after ten mins, contacted author immediatly and he seems to be working on it / restoring his account / removing malware on published packages.

Kinda "proud" on it haha :D

New comment by DDerTyp in "NPM debug and chalk packages compromised"

DDerTyp — Mon, 08 Sep 2025 16:16:34 +0000

One of the most insidious parts of this malware's payload, which isn't getting enough attention, is how it chooses the replacement wallet address. It doesn't just pick one at random from its list.

It actually calculates the Levenshtein distance between the legitimate address and every address in its own list. It then selects the attacker's address that is visually most similar to the original one.

This is a brilliant piece of social engineering baked right into the code. It's designed to specifically defeat the common security habit of only checking the first and last few characters of an address before confirming a transaction.

We did a full deobfuscation of the payload and analyzed this specific function. Wrote up the details here for anyone interested: https://jdstaerk.substack.com/p/we-just-found-malicious-code...

Stay safe!

New comment by DDerTyp in "NPM debug and chalk packages compromised"

DDerTyp — Mon, 08 Sep 2025 15:44:14 +0000

It looks like a lot of packages of the author have been compromised (in total over 1 billion downloads). I've updated the title an added information to the blog post.

New comment by DDerTyp in "NPM debug and chalk packages compromised"

DDerTyp — Mon, 08 Sep 2025 14:57:36 +0000

Update: It seems like all packages of the author got hacked.

New comment by DDerTyp in "NPM debug and chalk packages compromised"

DDerTyp — Mon, 08 Sep 2025 14:45:16 +0000

The discrepancy comes from how npm packages are published. What you see on GitHub is whatever the maintainer pushed to the repo, but what actually gets published to the npm registry doesn’t have to match the GitHub source. A maintainer (or someone with access) can publish a tarball that includes additional or modified files, even if those changes never appear in the GitHub repo. That’s why the obfuscated code shows up when inspecting the package on npmjs.com.

As for the “0 downloads” count: npm’s stats are not real-time. There’s usually a delay before download numbers update, and in some cases the beta UI shows incomplete data. Our pipeline picked up the malicious version because npm install resolved to it based on semver rules, even before the download stats reflected it. Running the build locally reproduced the same issue, which is how we detected it without necessarily incrementing the public counter immediately.

Npm packages with over 1b weekly downloads, incl. Chalk, have been compromised.

DDerTyp — Mon, 08 Sep 2025 14:03:26 +0000

Article URL: https://jdstaerk.substack.com/p/we-just-found-malicious-code-in-the

Hacker News: DDerTyp

PHP's CVSS 9.2 fixes: Memory exhaustion and stale request state

Fake GitHub Repositories Spreading Malware via PowerShell

Node.js Security Fix Silently Broke node-fetch, which broke other tools

Node-Fetch on latest Node Update broken

Ask HN: What would you like to be working on?

New comment by DDerTyp in "Don't become an engineering manager"

Nobel Peace Prize 2025: Venezuelan Politician Maria Corina Machado

New comment by DDerTyp in "I tracked Amazon's Prime Day prices. We've been played"

30–60–90-day guide to leading your new dev team like a pro

GitHub: Our plan for a more secure NPM supply chain

The September NPM Attack Was a Warning. Are We Listening?

New comment by DDerTyp in "NPM debug and chalk packages compromised"

New comment by DDerTyp in "NPM debug and chalk packages compromised"

New comment by DDerTyp in "NPM debug and chalk packages compromised"

New comment by DDerTyp in "NPM debug and chalk packages compromised"

New comment by DDerTyp in "NPM debug and chalk packages compromised"

New comment by DDerTyp in "NPM debug and chalk packages compromised"

New comment by DDerTyp in "NPM debug and chalk packages compromised"

Npm packages with over 1b weekly downloads, incl. Chalk, have been compromised.

Keyboard Is Holding Your AI Back