Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?
How about the idea that Node has been a hack from day one?
Node seems OK. NPM OTH is pretty sketch.
Many packages suddenly disappeared
171–180 of 520 posts
Re: Many packages suddenly disappeared
#172PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…
And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…
On top of that, they way countless packages are used everywhere is potentially exploitable: https://medium.com/@david.gilbertson/im-harvesting-credit-ca...
Re: Many packages suddenly disappeared
#173PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…
NPM doesn't make the package names unavailable after removal???
EDIT: That would be a massive security problem!
Re: Many packages suddenly disappeared
#174Hmm, I Java world we pretty much always used a local (company-owned) Maven proxy server, which grabbed packages from public repos and cached them locally to make sure builds still work if public servers were down or slow... or packages disappeared. This isn't a standard practice in JS world?
Not "standard", but there's definitely a couple solutions for this. We tried one at my work but it seemed a bit flakey.
Re: Many packages suddenly disappeared
#175We really need to hear from NPM why this happened. There is currently no way for a user to remove their own packages or unpublish packages anymore from the public NPM API ( a change following the `left-pad` incident ). This leads me to believe this was an internal NPM error. My guess is employee error.
Whaaa...? I swear I used `npm unpublish` several times in the past year.
Yeah, it definitely exists: https://docs.npmjs.com/cli/unpublish
Re: Many packages suddenly disappeared
#176Earlier quoted context omitted.
They document that they curate package names here: https://www.npmjs.com/policies/conduct I guess lots of people will think that a policy like Avoid using offensive or harassing package names, nicknames, or other identifiers that might detract from a friendly, safe, and welcoming environment for all. stifles their inner something or other though.
seems like a good reflection of the current social climate: they have a policy to prevent mildly offensive package names, and they enforce it, but they don't have a solution to packages randomly disappearing and being replaced with malicious versions.
I miss the days when everyone predicted and solved technical bugs with ease and didn’t have time to do eye—rollingly simple things like say “don’t be an idiot”. Remind me when that social climate was in place, again?
Re: Many packages suddenly disappeared
#177Didn't something similar happen last year? I think it was packages with similar names.
Yeah, there have been multiple typo-squatting incidents.
http://blog.npmjs.org/post/163723642530/crossenv-malware-on-...
Re: Many packages suddenly disappeared
#178Earlier quoted context omitted.
Dunno, but it's quite hard to resist childish urges. I note that "jew" is still available, and .jew is a perfectly valid extension which no program has ever claimed. I love all cultures. There's something worth learning from each of them, if you try. But emergent social dynamics are deeply interesting too: I get it (everyone does), and it makes perfect sense. Yet we've all collectively agreed that those are unwholeso…
> New Geometry Representation might be a fine name for a new format, but you're not going to use its acronym. I might... the acronym doesn't ring any bells and a Google search doesn't show anything special (if anything, it already shows a bunch of other things - including companies and organizations - using the same letters). What is the issue?
I think they are imagining people trying to pronounce the acronyms ngr and fgt and getting offensive words out of them. I don’t think that would have occurred to me.
Re: Many packages suddenly disappeared
#179Earlier quoted context omitted.
And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…
> Is there a valid defense for a platform whose security relies on the unanimous cooperation of a widely-scattered developer base? The defense is staged deployment and active users. This obviously depends on the blutness of the malicious code. If I may assume easily noticed effects of the malicious code: A dev at our place - using java with maven - would update the library, his workstation would get owned. This could…
> If we can't notice the malicious code at all until due to really really smart activation mechanisms... well then we're in NSA conspiracy land again.
What about really dumb activation methods? I.e., a condition that only triggers malicious behavior several months after the date the package was subverted. You don’t have to be the NSA to write that.
What’s scary here is that there are simpleminded attacks that, AFAIK, we don’t know how to defend against.
Re: Many packages suddenly disappeared
#180The latest Manifest.fm podcast episode is about typosquatting: