Post

Svelte
@svelte.dev

You've probably heard about the supply chain attack that affected a number of widely-used npm packages today. tl;dr: Don't panic. Notes: 1. Svelte, SvelteKit and their associated packages are not vulnerable to this attack, as they do not use any of the compromised dependencies in the browser

Svelte
@svelte.dev

2. The attack works by targeting users of browser extensions like MetaMask, patching `fetch` and `XMLHttpRequest` to steal crypto (excellent write-up here: jdstaerk.substack.com/p/we-just-fo...)

jdstaerk.substack.comAnatomy of a Billion-Download NPM Supply-Chain AttackA massive NPM supply chain attack has compromised foundational packages like Chalk, affecting over 1 billion weekly downloads. We dissect the crypto-stealing malware and show you how to protect your p...
Svelte
@svelte.dev

3. It's still _possible_ that you have these packages in your dependency graph (including transitively). The compromised packages have now been unpublished, but if you updated deps earlier today then it's possible your users are affected. List of affected packages here: socket.dev/blog/npm-aut...

socket.devnpm Author Qix Compromised via Phishing Email in Major Suppl...npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.
Svelte
@svelte.dev

4. This is one of the reasons we keep our dependency graph small and you should too!

3 reposts26 likes