Missing docs on how to view audit log of actions performed on npmjs
Nobody has claimed this yet.
- Dominant language
- MDX
- Stars
- 712
- Forks
- 4.2k
- Avg merge
- 4d 16h
- Merged PRs (30d)
- 3
Description
The axios/axios maintainer whose npm account was taken over can't seem to find the audit log of actions performed by attacker on the npm website.
Please document how account owners can view the audit log of actions performed with their account. This is important to allow victims to review what happened and create an incident timeline.
If no audit log feature exists, then add it as security improvement.
See https://github.com/axios/axios/issues/10604#issuecomment-4176697812
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no repository file or test. Start by reviewing the npm website and documentation entry points for account audit logs, then read the linked axios discussion for the incident context. Done means documenting how account owners can access the audit log, or clearly defining the missing feature if no audit log exists.
Written by the indexing model from the issue text.
Assessment
- Domain
- documentation, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100