Many packages suddenly disappeared

Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code.

Previously the package belonged to someone else: https://webcache.googleusercontent.com/search?q=cache:oDbrgP...

I'm not saying it's a malicious attempt, but it might be and it very much looks like. Be cautious as you might don't notice if some packages your code is dependent on were republished with a malicious code. It might take some time for NPM to sort this out and restore original packages.

Re: Many packages suddenly disappeared

#6

Post by the_duke » Sat, Jan 06, 2018, 7:52 PM UTC

Several packages just disapperead, now some are re-appearing, potentially uploaded by differnt users (!).

See https://github.com/npm/registry/issues/255 for details.

Very annoying, breaks builds all over, also prevents installing react-native.

Re: Many packages suddenly disappeared

#7

Post by chrisweekly » Sat, Jan 06, 2018, 7:52 PM UTC

> " Several packages including "require-from-string" are currently unavailable. We are aware of the issue and are working to restore the affected user and packages. Please do not attempt to republish packages, as this will hinder our progress in restoring them. Posted 4 minutes ago. Jan 06, 2018 - 19:45 UTC

"

https://status.npmjs.org/incidents/41zfb8qpvrdj