Re: [cdt-cloud-dev] compromised popular npm packages

[Bernd Hufmann <bernd.hufmann@xxxxxxxxxxxx>]

Thanks. Make sense.

The tracing related repos in cdt-cloud project only get security updates. So, we didn't receive those updates.

Bernd

---

From: cdt-cloud-dev <cdt-cloud-dev-bounces@xxxxxxxxxxx> on behalf of Jens Reinecke via cdt-cloud-dev <cdt-cloud-dev@xxxxxxxxxxx>
Sent: July 24, 2025 2:18 PM
To: CDT Cloud development <cdt-cloud-dev@xxxxxxxxxxx>
Cc: Jens Reinecke <Jens.Reinecke@xxxxxxx>
Subject: Re: [cdt-cloud-dev] compromised popular npm packages

 

Hi Bernd,

 

You can configure dependabot for security updates and/or regular version updates.

 

https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates

https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/about-dependabot-version-updates

 

I suspect it is the latter which triggered this for affected repos.

 

Cheers,

Jens

 

From: cdt-cloud-dev <cdt-cloud-dev-bounces@xxxxxxxxxxx> On Behalf Of Bernd Hufmann via cdt-cloud-dev
Sent: 24 July 2025 20:09
To: CDT Cloud development <cdt-cloud-dev@xxxxxxxxxxx>
Cc: Bernd Hufmann <bernd.hufmann@xxxxxxxxxxxx>
Subject: Re: [cdt-cloud-dev] compromised popular npm packages

 

Hi Jonah,

 

Thanks for the information. What also worries me is that dependabot created a PR to upgrade. Usually, dependapot does that based on some reported security alert. Do you have any idea how dependabot was triggered  and for what alert?

 

BR

Bernd

---

From: cdt-cloud-dev <cdt-cloud-dev-bounces@xxxxxxxxxxx> on behalf of Jonah Graham via cdt-cloud-dev <cdt-cloud-dev@xxxxxxxxxxx>
Sent: July 24, 2025 1:14 PM
To: CDT Cloud development <cdt-cloud-dev@xxxxxxxxxxx>
Cc: Jonah Graham <jonah@xxxxxxxxxxxxxxxx>
Subject: [cdt-cloud-dev] compromised popular npm packages

 

Hi folks,

 

Have a look at https://socket.dev/blog/npm-is-package-hijacked-in-expanding-supply-chain-attack - a bunch of very common packages in npm have been compromised.

 

The cdt-gdb-adapter's yarn.lock refers to one of them, but fortunately was never updated to a version that was compromised. However, if you did a local yarn upgrade you may have picked up a compromised version locally, you may also have other non-open source projects that are affected, so this message is an FYI for my entire cdt cloud community of npm consumers. 

 

Finally, be careful to not blindly apply dependabot PRs. dependeabot created a bunch of PRs to the compromised version (such as this one) - this time there were clues that the new versions were suspect because there were no commits or changelog entries for the compromised versions, but it can be hard to tell in the future what is compromised.

 

Best regards,

Jonah

 

 

~~~
Jonah Graham (he/him)
Kichwa Coders
www.kichwacoders.com

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.