Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Many packages suddenly disappeared

github.com

Post reply on HN
Print view View original

271–280 of 520 posts

Re: Many packages suddenly disappeared

#271

Post by paulddraper »

ilaksh wrote: post #187
sebazzz wrote: post #153

Can anyone explain why the npm registry still exists if it cannot guarantee that uploaded packages remain available? The current state makes it pretty useless as a reliable source te base software on because you never know if you're able to build it again in the future. They should take a good hard look at NuGet, which does not allow packages to be deleted so builds are guaranteed to be reliable. Still doesn't hurt t…

They don't allow packages to be deleted. A bug or server issue or mistake caused this. This type of problem has occurred only once before. In general npm has been extremely reliable and performant.

When was the only other time this problem happened?

Re: Many packages suddenly disappeared

#273

Post by marcosdumay »

newfoundglory wrote: post #189
foepys wrote: post #50

Earlier quoted context omitted.

I have recently taken over an Angular project (with a C# backend, thankfully) at my job. It took two hours to get it to even compile correctly because some dependencies were apparently outdated in package.json and it just ran on the other dev's machine by accident. I don't understand why I need over 100 dependencies for a simple Angular Single Page App that pulls JSON from the backend and pushes JSON back. Meanwhile,…

The basic explanation is that the dependencies for the angular app are much smaller, but I’m not sure which bit is confusing you. You don’t understand why an incorrectly written program required work to run when a bigger but correctly written program was easy?

> incorrectly written program

In principle programs shouldn't stop working just because they are old.

Yes, no language completely realize this. But there's a world of difference between C's "it was written only 40 years ago, why did compilers break it?" to Python's "yes, you are expected to review your code every 3 or 4 years", and there is another world of difference to the faster Javascript frameworks that practice "your code is 6 weeks too old, your looser!"

Re: Many packages suddenly disappeared

#274

Post by chrisfosterelli »

xwvvvvwx wrote: post #269
seldo wrote: post #268

Hi folks, npm COO here. This was an operational issue that we worked to correct. All packages are now restored: https://status.npmjs.org/incidents/41zfb8qpvrdj

What was the root cause of the issue?

Yes I'd be very curious to see a debrief on what the technical cause was. Thanks to the npm team for a quick weekend fix, at any rate!

Re: Many packages suddenly disappeared

#275

Post by danso »

notatoad wrote: post #96
maxerickson wrote: post #42

Earlier quoted context omitted.

They document that they curate package names here: https://www.npmjs.com/policies/conduct I guess lots of people will think that a policy like Avoid using offensive or harassing package names, nicknames, or other identifiers that might detract from a friendly, safe, and welcoming environment for all. stifles their inner something or other though.

seems like a good reflection of the current social climate: they have a policy to prevent mildly offensive package names, and they enforce it, but they don't have a solution to packages randomly disappearing and being replaced with malicious versions.

One thing is probably easier than the other, and can be tackled asynchronously.

Re: Many packages suddenly disappeared

#276

Post by antonkm »

jasonkester wrote: post #76
antonkm wrote: post #17

Gah. Moments like these always gives me a bit of panic, since I realize that so much of my software relies on external sources. Relying on npm, Atlassian/GitHub etc really hurts when stuff like this happens. Issues always gets resolved, but cases such as the GitLab incident should be enough to always keep some local copies around.

Why would you allow that to happen? I don't think there is any part of my little software empire that is dependant on code for which I don't have the source or underlying .dll checked into source control. It's part of your project. You absolutely need a copy of it.

I take it you're replying to me? My little software empire also keep local copies, that kind of defeats the purpose of using git for teamwork or package management to keep dependencies in check.

These are building blocks in a normal dev environment, and it would take me massive amounts of time to manage everything on my own.

The local copies are fragile and not as easily shared.

Re: Many packages suddenly disappeared

#277

Post by logantpowell »

incogitomode wrote: post #13
racbart wrote: post #5

PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…

I just tested, and it definitely looks like a troll / hack. > duplexer3@1.0.1 install /Users/foo/Code/foo/node_modules/duplexer3 > echo "To every thing there is a season, and a time to every purpose under the heaven: A time to be born, and a time to die; a time to plant, and a time to pluck up that which is planted; A time to kill, and a time to heal; a time to break down, and a time to build up; A time to weep, and…

I got this today as well! WTF? It showed up today and is preventing me from using npm, node, etc...

Re: Many packages suddenly disappeared

#278

Post by borntyping »

sergiotapia wrote: post #9

Yikes, what is it about node/npm/javascript that makes it feel like a house of cards?

The npm repository is the largest package repository in the world. A lot of the major incidents they've could have happened to other ecosystems (e.g. PyPi allows a user to delete packages that other packages depend on), but they've either not happened or haven't had as large an impact. When npm breaks, everyone notices, because everyone either uses npm or knows someone who does.

Re: Many packages suddenly disappeared

#279

Post by Silhouette »

jogjayr wrote: post #71

In my org, we use Artifactory as a cache between us and external sources. They have a free version too. I'd encourage everyone to use it, or something like it. Stop pointing your package managers to the public registry.

Stop pointing your package managers to the public registry.

Unfortunately with NPM this is still awkward, because as soon as you try to shrinkwrap your project, it doesn't just pin the version numbers, it also pins the full source location. That's in direct conflict with (and apparently takes precedence over) using one of the local caching proxies that would otherwise be a useful practical solution to this problem, and the situation gets even more complicated if you have people building at multiple locations and want each to have their own proxy.

Yarn seems to have a better approach to this. It has a few problems of its own, notably surprising, quiet updates to the lock file when using the default options (IMHO a mistake since the big selling point of Yarn is its deterministic, reproducible behaviour) but at least you can do something resembling a local cache combined with something resembling version pinning, which is the ante for any sane build system.

Re: Many packages suddenly disappeared

#280

Post by wybiral »

maxander wrote: post #121
racbart wrote: post #5

PSA: Please be cautious because this is an excellent opportunity for taking over packages and injecting malware by malicious people. Example: https://www.npmjs.com/package/duplexer3 which has 4M monthly downloads just reappeared, published by a fresh npm user. They published another two versions since then, so it's possible they've initially republished unchanged package, but now are messing with the code. Previously…

And all this is happening just as after the public release of a serious exploit which allows malicious code to do all sorts of nefarious things when it is somehow installed on the target machine . Hmm. Given that there's hints, at least, that the problems were caused by some particular developer's actions, I wonder about the security model for package-managed platforms altogether now. If I were a big cybercrime ring,…

An ipfs model would help. People would use a strong hash if the package or something.
Post reply on HN