npm: Compromised version of eslint-scope published
Timeline of updates
- resolved
We have now invalidated all npm tokens issued before 2018-07-12 12:30 UTC, eliminating the possibility of stolen tokens being used maliciously. This is the final immediate operational action we expect to take today. We will be conducting a forensic analysis of this incident to fully establish how many packages and users were affected, but our current belief is that it was a very small number. We will be conducting a deep audit of all the packages in the Registry to confirm this.
From npm’s published incident history: for incidents before Rewindex began polling this status page, only the final update text is available.
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.
Impact, status and times are the vendor’s own, as last archived. View on status.npmjs.org (opens in new tab).
Cite this
Status incident (vendor impact label: major) posted by npm, started 2018-07-12 16:13 UTC, resolved after 2.6 h, 1 update(s).
- Title
- Compromised version of eslint-scope published
- Vendor
- npm
- Date
- URL
- https://rewindex.com/company/npm/incidents/dn7c1fgrr7ng
npm profileRecent npm incidentsAll outages on July 12, 2018npm in July 2018MarkdownJSON