@cryptotaxi247 / documentation-1 / commits / 6f05dad

fix: bolding whitespace (#1183)

This extremely minor PR repairs MarkDown syntax in the threats-and-mitigations document to correctly bold-face a portion of the text. (Which was broken due to the markup being inserted as `the** email... address**.` instead of `the **email... address**.`) ## References

Frank Dana committed Jul 8, 2024 at 10:32 UTC 6f05dadd185da75e2803a3a584dc95bd7ad9fdf5

1 file changed +1 -1

content/threats-and-mitigations/index.mdx

+1 -1

@@ -18,7 +18,7 @@ We also recognize that passwords aren’t going away any time soon. For users th

19 Another method used to take over an account is by identifying accounts using an expired domain for their email address. An attacker could register the expired domain and recreate the email address used to register the account. With access to an account's registered email address an attacker could take over an account not protected by 2FA via a password reset.

21 -When a package is published the email address associated with the account, **at the time the package was published**, is included in the public metadata. Attackers are able to utilize this public data to identify accounts that might be susceptible to account takeover. It is important to note that the** email addresses stored in public metadata of packages are not updated when a maintainer updates their email address**. As such crawling public metadata to identify accounts susceptible to expired domain takeover will result in false positives, accounts that appear to be vulnerable but are not.

21 +When a package is published the email address associated with the account, **at the time the package was published**, is included in the public metadata. Attackers are able to utilize this public data to identify accounts that might be susceptible to account takeover. It is important to note that the **email addresses stored in public metadata of packages are not updated when a maintainer updates their email address**. As such crawling public metadata to identify accounts susceptible to expired domain takeover will result in false positives, accounts that appear to be vulnerable but are not.

23 npm does periodically check if accounts email addresses have expired domains or invalid MX records. When the domain has expired, we disable the account from doing a password reset and require the user to undergo account recovery or go through a successful authentication flow before they can reset their password.