Security alert! Bootloader Flashy may use infected npm package "rc"

[rsta2]

According to the references below, the npm package rc had versions published with malicious code. This package is installed, when npm install is executed in the directory tools/flashy. Please see the references for more info!

You should not install and use Flashy any more on your system and remove the setting USEFLASHY=1 from your Config.mk. The standard bootloader is used then, which is based on Python and is not infected.

• GHSA-g2q5-5433-rhrf
• Version 1.2.9 contains malicious code dominictarr/rc#131
• https://www.heise.de/news/Unbekannte-infiltrieren-Paketmanager-npm-und-verseuchen-Tools-mit-Schadcode-6260153.html (in German)

[rsta2]

The rc package in the npm package repository should be clean again, so using and installing Flashy is possible again. But you should be careful, because it's not clear, if this may happen again.

[rsta2]

I think, everything is told about this incident, as far this project is touched by it.