Top all-time · #21888
Observations
Personal blog · jdstaerk.substack.comsecurityprogrammingai
Observations is a personal blog at jdstaerk.substack.com about security, programming and ai. Since 2025, 3 different Hacker News readers have linked it 10 times, most often “Npm packages with over 1b weekly downloads, incl. Chalk, have been compromised.”. It is still writing: the last post was on 2026-10-27, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link these posts for the account of the compromised NPM debug and chalk packages and how a CI build failure exposed it. One post covers protecting against such attacks, with package.json overrides.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
I'm Jan. I write about technology, management, and what I observe along the way.
Most-linked posts?
- Npm packages with over 1b weekly downloads, incl. Chalk, have been compromised.2 people · 4 mentions · first linked 2025-09-08
What Hacker News says?
“Anatomy of a Billion-Download NPM Supply-Chain Attack”[0] suggests adding this to `package.json` for now... "overrides": { "chalk": "5.3.0", "strip-ansi": "7.1.0", "color-convert": "2.0.1", "color-name": "1.1.4", "is-core-module": "2.13.1", "error-ex": "1.3.2", "has-ansi": "5.0.1" } EDIT : This comment[1] suggests `npm audit` issue has now been resolved. [0] https://jdstaerk.substack.com/i/173095305/how-to-protect-…
Comment linking /i/173095305/how-to-protect-your-projects-immediate-steps
on “NPM debug and chalk packages compromised”Submitted Npm packages with over 1b weekly downloads, incl. Chalk, have been compromised. as a story · 23 points
HN discussionWould it be spotted quickly if nobody got the update though? It'd probably just go undetected for 3 days instead. In this case one team spotted it because their CI picked up the new version ( https://jdstaerk.substack.com/p/we-just-found-malicious-code... ).
Comment linking /p/we-just-found-malicious-code-in-the
on “NPM debug and chalk packages compromised”Submitted Node.js Security Fix Silently Broke node-fetch, which broke other tools as a story · 2 points
HN discussionOne of the most insidious parts of this malware's payload, which isn't getting enough attention, is how it chooses the replacement wallet address. It doesn't just pick one at random from its list. It actually calculates the Levenshtein distance between the legitimate address and every address in its own list. It then selects the attacker's address that is visually most similar to the original one. This is a brillian…
Comment linking /p/we-just-found-malicious-code-in-the
on “NPM debug and chalk packages compromised”Submitted The September NPM Attack Was a Warning. Are We Listening? as a story · 2 points
HN discussionIn the case of the chalk/debug etc hack, the first detection seemed to come from a CI build failure it caused: https://jdstaerk.substack.com/p/we-just-found-malicious-code... > It started with a cryptic build failure in our CI/CD pipeline, which my colleague noticed > This seemingly minor error was the first sign of a sophisticated supply chain attack. We traced the failure to a small dependency, error-ex. Our packa…
Comment linking /p/we-just-found-malicious-code-in-the
on “Pnpm has a new setting to stave off supply chain attacks”Submitted Keyboard Is Holding Your AI Back as a story · 2 points
HN discussionSubmitted PHP's CVSS 9.2 fixes: Memory exhaustion and stale request state as a story · 1 points
HN discussionSubmitted Fake GitHub Repositories Spreading Malware via PowerShell as a story · 1 points
HN discussion
