<story><title>Survey of popular Node.js packages reveals credential leaks</title><url>https://github.com/ChALkeR/notes/blob/master/Do-not-underestimate-credentials-leaks.md</url></story><parent_chain></parent_chain><comment><author>seldo</author><text>Many thanks to ChALkeR for responsibly disclosing this to npm and giving us time to notify people and clean up as much as possible. We were very busy, and ChALkeR was incredibly patient with us :-)&lt;p&gt;In response to this disclosure, we have set up a continuously-running scanner for credential leakages of various kinds. It&amp;#x27;s not foolproof, but it&amp;#x27;s made things a lot better. We&amp;#x27;ll be writing a proper blog post about this at some point, but we&amp;#x27;ve been really busy!</text></comment>
<story><title>Survey of popular Node.js packages reveals credential leaks</title><url>https://github.com/ChALkeR/notes/blob/master/Do-not-underestimate-credentials-leaks.md</url></story><parent_chain></parent_chain><comment><author>tjholowaychuk</author><text>I&amp;#x27;m sure I&amp;#x27;ve done this in the past haha, the npm workflow isn&amp;#x27;t great at times in this regard. If you have something (to test etc) that is not checked into Git, but still in the directory, it can still make its way into a publish. That&amp;#x27;s definitely what I&amp;#x27;d advise people to be most careful of, use npm-link and use credentials elsewhere etc.&lt;p&gt;Koa I&amp;#x27;m curious of, I&amp;#x27;ve seen almost every pull-request go in there, anyway nice post.</text></comment>