Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

31–40 of 520 posts

Re: Many packages suddenly disappeared

#31

Post by dhzjxnbzn »

shrimp_emoji wrote: post #29
shawn wrote: post #15

So, funny story: I registered the "nazi" npm package. When you require it, it says "I did nazi that coming." That's it. (Though it would've been a funny name for a linter.) ... Or it did. I received a harshly worded letter from npm saying they axed it. It hit all the talking points about inclusiveness and making sure no one feels even slightly annoyed. Meh. No point to this story. Just an interesting situation with a…

Does "stalinist" work?

"I did stalinist see that coming" doesn't have the same ring to it.

Re: Many packages suddenly disappeared

#32

Post by nukeop »

NPM is extremely vulnerable to typosquatting. Be cautious with what you install. The install scripts can execute arbitrary code. NPM's team response is that they hope that malicious actor won't exploit this behaviour. According to my tests, typosquatting 3 popular packages allows to take over around 200 computers in 2 weeks time it takes their moderators to notice it.

Re: Many packages suddenly disappeared

#33

Post by yladiz »

I don't remember the intricacies of NPM or Yarn, but don't one/both of them have resource integrity enabled, so that you know that the package that's being installed is the one in your lock file? If not, why isn't this a feature especially after the clusterfuck of the guy deleting all his packages back about two years ago, breaking tons of things including Babel and React?

This wouldn't fix the issue of someone deleting the actual package (this happened here?), but it would prevent some malicious code being installed if someone uses the same package name.

Re: Many packages suddenly disappeared

#34

Post by tw1010 »

I don't understand much about the blockchain, but one thing I have heard is that it's impossible (or very hard) to remove things from it. It is immutable, sort of append only, if I understand it correctly. So my question is, is there anyone working on moving npm to the blockchain? Or doing something like a package manager on the blockchain? If not, why not?

Re: Many packages suddenly disappeared

#36

Post by eropple »

swang wrote: post #12
racbart wrote: post #5

PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…

didn't npm make some changes where a published package name cannot be republished, at least not without npm intervention?

Yes, but the packages disappeared. That people can dupe these suggests that the database was modified.

Re: Many packages suddenly disappeared

#37

Post by throwaway66666 »

I never understood the love for package managers that directly hook and import things into your codebase or repo or even worse servers. I guess the benefit is that "it just works", but the fact that you do not know where a package is coming from can't be worrying just me.

In my company we take the stable version of the library we want to use and we self-host it. We basically have added a cache that we manage and control what goes into it instead of just trusting a manager. Especially for server-side deployment this is mandatory for security. Things like let's say ffmpeg etc - we never get from random packages but we host them ourselves.

Re: Many packages suddenly disappeared

#38

Post by z3t4 »

And ppl think i'm crazy for keeping packages in SCM repo. NPM get so much abuse, people depending on them without paying a dime. At least put up a caching proxy hosted by your own if you depend so much on npm for your operations.

Re: Many packages suddenly disappeared

#39

Post by fareesh »

vitaliyf wrote: post #25
StavrosK wrote: post #19

Earlier quoted context omitted.

What's the alternative? Have the maintainer snail-mail you the packages?

You run a private NPM mirror where you copy dependencies that you rely on, after auditing them (for code quality and licensing).

Realistically if someone were to sneak something in, what kind of audit would you need to be able to catch it?

Re: Many packages suddenly disappeared

#40

Post by tlarkworthy »

tw1010 wrote: post #34

I don't understand much about the blockchain, but one thing I have heard is that it's impossible (or very hard) to remove things from it. It is immutable, sort of append only, if I understand it correctly. So my question is, is there anyone working on moving npm to the blockchain? Or doing something like a package manager on the blockchain? If not, why not?

I don't want to have to download 135 gigabytes to require left-pad.
Post reply on HN