A place for developers to talk about building on Farcaster.

/dev

> Any computer that has this package installed or running should be considered fully compromised

> Any computer that has this package installed or running should be considered fully compromised

https://github.com/advisories/GHSA-2mhj-xmf4-pr8m

Earlier today, a publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and…

Anza

Staff Eng at Iron Fish 🐟 • Building BlockSocks 🧦 • Denver, CO 📍

More info: https://x.com/anza_xyz/status/1864085236432134264

Co-Founder 

Contact: https://alice.chain.box

https://x.com/anza_xyz/status/1864085236432134264

Why? Is there any report beyond package bad? 

only appears to affect projects that directly handle private keys and that updated within the window of 3:20pm UTC and 8:25pm UTC on Tuesday, December 2, 2024.

as a transitive dep its part of literally every pkg.