Josh Junon

Lrrr from Omicron Persei 8 (Futurama)

it's true what they say; 8 comes from 010, false comes from Norway

From your perspective, what's the most painful part of deploying or managing such systems?

Come to Germany, we have pumpkin everything here

Yes. You should. But also there's nothing wrong with this, either.

Honestly start with Unity. It might not be your "forever engine" but it's super approachable, easy to learn, and C# is probably one of the softer introductions to programming that there is. Much of what you learn there will be transferrable knowledge to other engines.

Hugops going out to everyone affected by the worm today. Ping me to DM and AMA if you've been affected. Will guide and assist as best as I can.

That's wild. Alt would have been kind of fun.

Also shoutout to the GH employee that reviewed the CVE request in minutes; I assume that was a real human doing that. Thank you.

(and sorry for taking so long, I didn't quite know how to go about doing anything like this at this scale before. I will definitely document this for others to get an idea, hopefully it saves some headache later)

debug: CVE-2025-59144
error-ex: CVE-2025-59330
color-string: CVE-2025-59142
backslash: CVE-2025-59140
is-arrayish: CVE-2025-59331
simple-swizzle: CVE-2025-59141
color: CVE-2025-59143
color-convert: CVE-2025-59162
color-name: CVE-2025-59145 <pending publication>

Chalk pkgs still pending; bear with.

Would be curious to know which parts are recognizable from early Rust.

I have the NPM logs. Not much unexpected except an IP address that wasn't previously known.

It seems clear it was indeed an MITM via the known IP that's out there, followed by account actions via a private IPv6 address.

Hi, I missed error-ex in the publishing spree the other day, will publish a new version shortly. My apologies, been another round of busy days/weekend.

Still waiting for access to account logs for the post mortem. Trying to get it out ASAP, sorry to those who need it. Doing my best to get it done.

It's called a tracker, usually software for writing music for retro consoles and the like. You can usually google "<console name> tracker software" and find what you're looking for.

Fantastic work, thank you for sharing it!

This is the most beautiful arrangement of this piece I've ever heard. Did you arrange this yourself?

That's what I thought at first too, but the GitHub staff and others have asked me to do so. CWE type is 506 (Embedded Malicious Code), and there *is* a specific version that is malicious. Fits all the criteria for a CVE.

All packages have been published over. Please let me know if I broke you somehow and I'll get it fixed ASAP.

Security advisories drafted and CVEs requested; not sure if they should be published immediately without the CVE yet so have held off until I get some guidance (or they're alloc'd).

Half of the packages have been published now, slowly working through them. If you see anything messed up please let me know.

Took the first real break last night in a week. Highly necessary. Thanks to those who reached out for npm contacts, sounds like things will get handled today.

Sent you a DM :)

Post mortem is still on hold until I can get everyone secure again. Npm has not been helpful and I'm currently blocked.

I'm sorry for the continued delay, I'd like to be done with this more than anyone else, believe me.

Does anyone have a contact at npm who can contact me directly? This is getting silly.

Non sequiturs and hours between responses is so unprofessional I'm getting irritated.

People are still affected by cached versions with malware and once again there's nothing I can do to help them.

Hi, something still isn't right with my account configuration. Going to hold off on the package updates until I can receive a response from npm.

There is no threat or continued breach, but I'm not able to publish in a way I'm confident will be secure quite yet. Please bear with.

We Got Lucky: The Supply Chain Disaster That Almost Happened Eighteen widely used open source packages were compromised, downloaded billions of times and embedded across nearly every cloud environment. The community dodged a bullet. But this close call shows ju...

Yesterday, @advocatemack.bsky.social and I sat down with @bad-at-computer.bsky.social to discuss the incident that occurred on Monday, in which popular packages like debug and chalk were compromised. Here's my take on it, along with the entire ~45-minute conversation.

www.aikido.dev/blog/we-got-...

Forgot to mention, they will be identical to the current (non-compromised) versions, released as <compromised_version + 1 patch>.

⚠️ Heads Up: New patch versions of all affected repositories will be going out today. Please expect that.

Will start in the next hour and will be taking things very slowly.

Chalk repositories are not included in this, as Sindre has already taken care of them.

I am terrified, lmk if I mess up.

Yes definitely a preventative measure for sure, and I'll include that in a "once you have access again" section. FWIW the npm account is now MFA'd with a u2f key, which should have been on it for a long time now.

Keeping in mind that a post mortem is on the way and that new package versions will be pushed today, if you have any process improvements you think should be included, (aside from "don't get phished"), I'd love to hear them - even if you're not a security professional.