12 replies

1. Private reply 15 min later
   1. Private reply 17 min later
      1. Private reply 17 min later
2. Zach Leatherman 33 min later

   whew, it’s been taken down a mere 5 hours after publish.

   1. Slab Bulkhead 36 min later

      @zachleat the cheap joke: someone at npm finally got VP level permission to turn off Copilot to make the change.

      1. Zach Leatherman 42 min later

         @slab_bulkhead vibe coding our way to a fix

   2. Alex Grant 4 hr later

      @zachleat

      Still cached. Still rocking the exploit.

      #jest download after 6pm eastern still delivering 64k of injected who-knows-what

      1. Zach Leatherman 4 hr later

         @localnerve your local cache might still have it, I suppose!

         1. Alex Grant 4 hr later

            @zachleat

            Oh eek. Thanks 👍

3. Stuart Langridge 36 min later

   @zachleat the is-arrayish half of this broke our build today: purely fortunate that (I think that) the people who compromised the package screwed up the package.json. It was rectified pretty fast, but... bit worrying.

   1. Zach Leatherman 46 min later

      @sil yeah, absolutely. `is-arrayish` is a wild package to begin with

      1. Stuart Langridge 47 min later

         @zachleat ya. I'd never heard of it, and was a bit surprised when I found what it was (it turned out, obviously, to be somewhere about nine layers deep in the dependency tree). That trend for single-line packages is pretty annoying.