Allthenticate

🔒 Phishing Friday: The npm Supply-Chain Hack

Attackers hit npm (Node Package Manager) — the backbone of JavaScript apps — with a single phishing email.

A maintainer was tricked into giving up their login and two-factor authentication (2FA) code, letting attackers publish malicious updates to 19 popular packages used over 2 billion times a week.

The result: crypto wallets drained, thousands of apps potentially shipping tainted code, and teams scrambling through costly audits and rebuilds. ALL from stolen credentials — no zero-day, no clever exploit, just a password and code that shouldn’t exist in the first place.

With Allthenticate’s hardware-bound, passwordless authentication, there’s nothing to steal. No password, no code, no session to replay. Even if the maintainer clicked the phishing email, the attacker’s machine would hit a wall — the key would never sign a login.

Credential theft is still the #1 attack vector. The solution isn’t more training — it’s removing credentials entirely.

🎣 Skip the phish. Keep moving.

One bad click can slow the whole team.
Allthenticate uses the power already in your phone to prove you’re you—no passwords, no panic, no slowdown.

Wondering what’s so bad about phishing (and how to stop it from happening)?

Check out the phishing page on allthenticate.com - via Allthenticate’s Knowledge Base:

📖 2-minute read: https://www.allthenticate.com/knowledge/phishing

Join us at Authenticate 2024! 🚀

📍 Booth C4: Try Allthenticate’s unified access control solution
🎁 Enter our drone giveaway

🗣️ Don’t miss our CEO Chad Spensky’s talk: “Web 3.0 Before It Was Cool: Why Decentralized Authentication is the Future and the Past”
📅 Wednesday, October 16
🕛 12:00 - 12:25 PM

Experience how one app secures both physical and digital assets. From turnstiles to desktops (and more), we’re simplifying security without compromising on strength.

P.S. It’s Chad’s birthday today! 🎂 Stop by our booth to wish him well and chat about the future of authentication!