Good reminder to use a password manager as well (as it would also catch the 'npnjs' typo squatted domain too).
Similar incident happened to the HIBP guy who mentioned ignoring the password manager safeguards due to being half asleep while on the plane.
Also keep in mind you can disable install scripts in npm from running (if you happen to not do your development in an isolated environment) via configuring your .npmrc with
> ignore-scripts=true
Stay safe out there
This is wild to me, not just because they're a developer but they even know about SPF/DMARC. Also, the content of the email being them asking to reverify your email sounds suspicious and illogical. I know people make mistakes, but it's just crazy, and shows the importance of companies training employees to not fall for phishing emails.
The sender email address could be more prominent.
All link URLs could be visible.
Emails from new senders could have some sort of warning/alert. I used to use an email client that let you approve incoming email addresses, and it once saved me from a Coinbase phishing email since it made me double check the sender since it was marked as unapproved.
We can't keep blaming the victim when our own software works in the favor of bad actors. You're going to let your guard down one day.
Use a better package manager that always disables installation scripts and lets you whitelist only those you absolutely need (like pnpm — which asks you post-install if any scripts were necessary, and reruns those you confirm).
Also avoid horrible tire fires like eslint that require several hundreds of unvetted dependencies. If you work alone and are disciplined, it's perfectly possible to write good TS without a linter. If not — use biomejs.dev (zero external dependencies) or `deno lint`.
Also node can easily be isolated from the rest of the system through bubblewrap/firejail:
$ ls -a ~
. .. code
It's the primary way suggested to integrate the two https://prettier.io/docs/integrating-with-linters
it looks like installing a dll so maybe it's windows only?
https://github.com/prettier/eslint-config-prettier/issues/33...